From c61157aca3c3cbe7a10c133e4d07787552cc5478 Mon Sep 17 00:00:00 2001 From: gluap Date: Tue, 12 Apr 2022 20:11:34 +0200 Subject: [PATCH] do not serve files from outside the frontend dir. --- api/obs/api/routes/frontend.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/api/obs/api/routes/frontend.py b/api/obs/api/routes/frontend.py index 2334e34..fb681a0 100644 --- a/api/obs/api/routes/frontend.py +++ b/api/obs/api/routes/frontend.py @@ -1,4 +1,4 @@ -from os.path import join, exists, isfile +from os.path import join, exists, isfile, abspath import sanic.response as response from sanic.exceptions import NotFound @@ -50,6 +50,9 @@ if INDEX_HTML and exists(INDEX_HTML): raise NotFound() file = join(app.config.FRONTEND_DIR, path) + if not abspath(file).startswith(abspath(app.config.FRONTEND_DIR)): + raise NotFound() + if not exists(file) or not path or not isfile(file): return response.html( index_file_contents.replace("__BASE_HREF__", req.ctx.frontend_url + "/")