Fixed: filepath for the blog is now specifically set to only allow files to be accessed if they exist in directory, writing this now I realise that the approach could mean that ../../../blog_name could be accessed still

src/main.zig

@@ -3,11 +3,11 @@ const zap = @import("zap");
 const Allocator = std.mem.Allocator;
 //fn dispatch_routes(r: zap.Request) void {
 //    if (r.path) |the_path| {
-//        std.debug.print("PATH: {s}\n", .{the_path});
+//        std.log.print("PATH: {s}\n", .{the_path});
 //   }
 //
 //    if (r.query) |the_query| {
-//       std.debug.print("QUERY: {s}\n", .{the_query});
+//       std.log.print("QUERY: {s}\n", .{the_query});
 //    }
 //    if (r.path) |path| {
 //        if (routes.get(path)) |method| {
@@ -61,13 +61,39 @@ pub fn blog(self: *Self, req: zap.Request) void {
     // looking for /blog?post=post_name
     if(req.getParamSlice("post")) |value| {
         std.log.info("post name: {s}", .{value});
-        const filepath = std.fmt.allocPrint(self.allocator, "src/public/blog/{s}", .{value}) catch return;
+
-        defer self.allocator.free(filepath);
+        const filepath = std.fmt.allocPrint(self.allocator, "./src/public/blog/{s}", .{value}) catch return;
-        const file_content = std.fs.cwd().readFileAlloc(self.allocator, filepath, std.math.maxInt(usize)) catch return;
+        const dir = std.fs.cwd().openDir("./src/public/blog", .{ .iterate = true }) catch return;
-        defer self.allocator.free(file_content);
+        var walker = dir.walk(self.allocator) catch return;
-        req.sendBody(file_content) catch return;
+        defer walker.deinit();
+        while (walker.next() catch return) |entry| {
+            std.log.info("entry: {s}", .{entry.path});
+            if(std.mem.eql(u8,entry.path,value)) {
+                const file_content = std.fs.cwd().readFileAlloc(self.allocator, filepath, std.math.maxInt(usize)) catch return;
+                defer self.allocator.free(file_content);
+                req.sendBody(file_content) catch return;
+            }
+        }
+
+ //       defer self.allocator.free(filepath);
+   //     const file_content = std.fs.cwd().readFileAlloc(self.allocator, filepath, std.math.maxInt(usize)) catch return;
+     //   defer self.allocator.free(file_content);
+      //  const absolute_filepath = std.fs.cwd().realpathAlloc(self.allocator, filepath) catch return;
+      //  defer self.allocator.free(absolute_filepath);
+      //  std.log.info("absolute_filepath: {s}\n", .{absolute_filepath});
+      //  var walker = dir.walk(self.allocator) catch return;
+      //  defer walker.deinit();
+      //  while (walker.next() catch return) |entry| {
+      //      const abs_p = std.fs.cwd().realpathAlloc(self.allocator, entry.path) catch return;
+      //      defer self.allocator.free(abs_p);
+       //     std.log.info("abs_entry: {s}", .{abs_p});
+      //      std.log.info("entry: {s}", .{entry.path});
+      //  }
+      //  std.log.info("pwd: {s}", .{std.fs.cwd().realpathAlloc(self.allocator, ".") catch return});
+
+    //    req.sendBody(file_content) catch return;
     }
-    req.sendBody("ERROR: !") catch return;
+    req.sendBody("ERROR: You shouldn't be looking here.") catch return;
 
 }
 };
@@ -112,7 +138,7 @@ pub fn main() !void {
     var listener = zap.HttpListener.init(.{ .port = 4000, .on_request = router.on_request_handler(), .log = true, .max_clients = 100000, .public_folder = "src/public" });
     try listener.listen();
 
-    std.debug.print("Listening on 0.0.0.0:4000\n", .{});
+    std.log.info("Listening on 0.0.0.0:4000\n", .{});
 
     zap.start(.{
         .threads = 2,