From c3255b51fdc91a7f90e05d657e8efb1bd545a218 Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Wed, 27 May 2026 11:29:11 -0700 Subject: [PATCH] fix(volume): avoid panic when URL path has a dot before the comma (#9712) LastIndex returns -1 when the separator is missing and can return any position when both are present. A path like /vol/file.jpg,abc gives dotSepend and panics. Only treat the dot as an extension boundary when it sits after the comma. --- weed/storage/needle/needle.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/weed/storage/needle/needle.go b/weed/storage/needle/needle.go index 7c0ce1c20..716ef99a7 100644 --- a/weed/storage/needle/needle.go +++ b/weed/storage/needle/needle.go @@ -110,7 +110,8 @@ func CreateNeedleFromRequest(r *http.Request, fixJpgOrientation bool, sizeLimit commaSep := strings.LastIndex(r.URL.Path, ",") dotSep := strings.LastIndex(r.URL.Path, ".") fid := r.URL.Path[commaSep+1:] - if dotSep > 0 { + // dot must be after comma; otherwise path[commaSep+1:dotSep] panics + if dotSep > commaSep { fid = r.URL.Path[commaSep+1 : dotSep] }