Do not allow \ or @ in URL

web/handler.go

@@ -8,6 +8,7 @@ import (
 	"log"
 	"net"
 	"net/http"
+	"regexp"
 	"strings"
 
 	"github.com/markbates/pkger"
@@ -17,6 +18,11 @@ import (
 	"gitlab.crans.org/nounous/ghostream/stream/webrtc"
 )
 
+var (
+	// Precompile regex
+	validPath = regexp.MustCompile("^/[a-z0-9_-]*$")
+)
+
 // Handle WebRTC session description exchange via POST
 func viewerPostHandler(w http.ResponseWriter, r *http.Request) {
 	// Limit response body to 128KB