From 557fff80edc9a528af2aa38577eb2fea2795eb80 Mon Sep 17 00:00:00 2001 From: gluap Date: Tue, 12 Apr 2022 21:59:33 +0200 Subject: [PATCH] backport fix to 0.5.0 --- api/obs/api/routes/frontend.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/api/obs/api/routes/frontend.py b/api/obs/api/routes/frontend.py index 2334e34..fb681a0 100644 --- a/api/obs/api/routes/frontend.py +++ b/api/obs/api/routes/frontend.py @@ -1,4 +1,4 @@ -from os.path import join, exists, isfile +from os.path import join, exists, isfile, abspath import sanic.response as response from sanic.exceptions import NotFound @@ -50,6 +50,9 @@ if INDEX_HTML and exists(INDEX_HTML): raise NotFound() file = join(app.config.FRONTEND_DIR, path) + if not abspath(file).startswith(abspath(app.config.FRONTEND_DIR)): + raise NotFound() + if not exists(file) or not path or not isfile(file): return response.html( index_file_contents.replace("__BASE_HREF__", req.ctx.frontend_url + "/")