github/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2025-12-10 16:51:24 +01:00
Code Issues Projects Releases Packages Wiki Activity

Fix static mounts using relative paths and prevent traversal exploits (#554)

Browse source 
Thanks, @abdusco! Closes #555
This commit is contained in:
Abdus 2019-07-11 19:13:19 +03:00 • committed by Simon Willison
commit 74ecf8a7cc
3 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
datasette/utils/__init__.py
View file

@ -735,7 +735,8 @@ class StaticMount(click.ParamType):
param,
ctx,
)
path, dirpath = value.split(":")
path, dirpath = value.split(":", 1)
dirpath = os.path.abspath(dirpath)
if not os.path.exists(dirpath) or not os.path.isdir(dirpath):
self.fail("%s is not a valid directory path" % value, param, ctx)
return path, dirpath