Changeset Navigation

Changeset 922

Timestamp:

01/10/06 15:47:24

Author:

fumanchu

Message:

A more inclusive, os-level check for staticfilter uplevel attacks.

Files:

r921	r922
24	24	return
25	25
	26	root = config.get('static_filter.root', '').rstrip(r"\/")
26	27	filename = config.get('static_filter.file')
27		if not filename:
	28	if filename:
	29	staticDir = None
	30	else:
28	31	staticDir = config.get('static_filter.dir')
29	32	if not staticDir:
…	…
39	42	extraPath = urllib.unquote(extraPath)
40	43	# If extraPath is "", filename will end in a slash
41		~~if '..' in extraPath:~~
42		~~# Disallow '..' (security flaw)~~
43		~~raise cherrypy.HTTPError(403) # Forbidden~~
44	44	filename = os.path.join(staticDir, extraPath)
45	45
…	…
48	48	# a relative path to serveFile.
49	49	if not os.path.isabs(filename):
50		~~root = config.get('static_filter.root', '').rstrip(r"\/")~~
51	50	if not root:
52	51	msg = ("StaticFilter requires an absolute final path. "
…	…
55	54	filename = os.path.join(root, filename)
56	55
	56	# If we used static_filter.dir, then there's a chance that the
	57	# extraPath pulled from the URL might have ".." or similar uplevel
	58	# attacks in it. Check that the final file is a child of staticDir.
	59	# Note that we do not check static_filter.file--that can point
	60	# anywhere (since it does not use the request URL).
	61	if staticDir:
	62	if not os.path.isabs(staticDir):
	63	staticDir = os.path.join(root, staticDir)
	64	if not os.path.normpath(filename).startswith(os.path.normpath(staticDir)):
	65	raise cherrypy.HTTPError(403) # Forbidden
	66
57	67	try:
58	68	cptools.serveFile(filename)