backup/pywb
1
0
Fork 0
mirror of https://github.com/webrecorder/pywb.git synced 2025-03-15 00:03:28 +01:00
Code Issues Projects Releases Activity

Remove abspath, add validation back

Browse Source
This commit is contained in:
Tessa Walsh 2024-11-05 12:13:58 -05:00
parent 41dccf8fe3
commit 6259c88b75
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
pywb/apps/static_handler.py
View File

@ -32,20 +32,20 @@ class StaticHandler(object):
full_path = environ.get('pywb.static_dir') full_path = environ.get('pywb.static_dir')
if full_path: if full_path:
static_path_to_validate = os.path.abspath(full_path) static_path_to_validate = full_path
full_path = os.path.join(full_path, url) full_path = os.path.join(full_path, url)
if not os.path.isfile(full_path): if not os.path.isfile(full_path):
full_path = None full_path = None
if not full_path: if not full_path:
static_path_to_validate = os.path.abspath(self.static_path) static_path_to_validate = self.static_path
full_path = os.path.join(self.static_path, url) full_path = os.path.join(self.static_path, url)
# try: try:
# validate_requested_file_path(static_path_to_validate, url) validate_requested_file_path(static_path_to_validate, url)
# except ValueError: except ValueError:
# raise NotFoundException('Static File Not Found: ' + raise NotFoundException('Static File Not Found: ' +
# url_str) url_str)
try: try:
data = self.block_loader.load(full_path) data = self.block_loader.load(full_path)
@ -84,7 +84,7 @@ class StaticHandler(object):
"""Validate that requested relative file path is within static dir. """Validate that requested relative file path is within static dir.
Returns relative path starting from static_dir or raises ValueError if Returns relative path starting from static_dir or raises ValueError if
requested path is not in the static directory. path traversal outside the static directory is being attempted.
""" """
static_dir = Path(static_dir) static_dir = Path(static_dir)
return static_dir.joinpath(requested_path).resolve().relative_to(static_dir.resolve()) return static_dir.joinpath(requested_path).resolve().relative_to(static_dir.resolve())