fixed path on legacy support for X_RELATIVE_PATH

Signed-off-by: Matt Butcher <matt.butcher@microsoft.com>

Author: technosophos

README.md

@@ -138,6 +138,11 @@ SOFTWARE
 
 The fileserver took `/static/filserver.gr`, removed the `/static/` part from the front, and then loaded `fileserver.gr` from the directory mounted in the `modules.toml`. Note that any subdirectories are also served. So `/static/foo/bar` would translate to the path `foo/bar` inside of the WebAssembly module (which in the example above would fully resolve to "/path/to/fileserver/foo/bar").
 
+## Security Note
+
+The Wagi fileserver is designed to serve any file mounted in the volume. Do not mount a
+volume that contains files you do not want served.
+
 ## Code of Conduct
 
 This project has adopted the [Microsoft Open Source Code of

fileserver.gr

@@ -51,7 +51,7 @@ let guestpath = (env) => {
     // Backward compat for an older version of Wagi that had PATH_INFO wrong.
     // X_RELATIVE_PATH was removed before Wagi 0.4
     match (Map.get("X_RELATIVE_PATH", env)) {
-        Some(p) => p,
+        Some(p) => String.concat("/", p),
         None => {
             Option.unwrap(Map.get("PATH_INFO", env))
         }