HelloZeroNet
/
ZeroNet
mirror of https://github.com/HelloZeroNet/ZeroNet.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge pull request #2061 from imachug/dotdot 

Allow some paths to contain .. but not ../
This commit is contained in:
ZeroNet 2019-07-01 17:56:27 +02:00 committed by GitHub
parent eae0d1b2a6 743f92d15e
commit f83ade8d33
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/Site/SiteStorage.py
View File

@ -382,7 +382,7 @@ class SiteStorage(object):
if not inner_path:
return self.directory
if ".." in inner_path:
if "../" in inner_path:
raise Exception("File not allowed: %s" % inner_path)
return "%s/%s" % (self.directory, inner_path)

4
src/Ui/UiRequest.py
View File

@ -524,7 +524,7 @@ class UiRequest(object):
if path.endswith("/"):
path = path + "index.html"
if ".." in path or "./" in path:
if "../" in path or "./" in path:
raise SecurityError("Invalid path")
match = re.match(r"/media/(?P<address>[A-Za-z0-9]+[A-Za-z0-9\._-]+)(?P<inner_path>/.*|$)", path)
@ -603,7 +603,7 @@ class UiRequest(object):
if match: # Looks like a valid path
file_path = "src/Ui/media/%s" % match.group("inner_path")
allowed_dir = os.path.abspath("src/Ui/media") # Only files within data/sitehash allowed
if ".." in file_path or not os.path.dirname(os.path.abspath(file_path)).startswith(allowed_dir):
if "../" in file_path or not os.path.dirname(os.path.abspath(file_path)).startswith(allowed_dir):
# File not in allowed path
return self.error403()
else: