github/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2025-12-10 16:51:24 +01:00
Code Issues Projects Releases Packages Wiki Activity

Fix static mounts using relative paths and prevent traversal exploits (#554)

Browse source 
Thanks, @abdusco! Closes #555
This commit is contained in:
Abdus 2019-07-11 19:13:19 +03:00 • committed by Simon Willison
commit 74ecf8a7cc
3 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
datasette/utils/asgi.py
View file

@ -300,7 +300,11 @@ async def asgi_send_file(
def asgi_static(root_path, chunk_size=4096, headers=None, content_type=None):
async def inner_static(scope, receive, send):
path = scope["url_route"]["kwargs"]["path"]
full_path = (Path(root_path) / path).absolute()
try:
full_path = (Path(root_path) / path).resolve().absolute()
except FileNotFoundError:
await asgi_send_html(send, "404", 404)
return
# Ensure full_path is within root_path to avoid weird "../" tricks
try:
full_path.relative_to(root_path)