Mercurial > hg > FileServer

comparison fileserver/web.py @ 17:27bd18f0a359

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
fix up security hole
author Jeff Hammel <jhammel@mozilla.com>
date Wed, 29 Feb 2012 16:01:38 -0800
parents e3993fa05b89
children 1eb5e82605a5
comparison
equal deleted inserted replaced
16:4f26df21dc12 17:27bd18f0a359
47 47
48 @staticmethod 48 @staticmethod
49 def normpath(path): 49 def normpath(path):
50 return os.path.normcase(os.path.abspath(path)) 50 return os.path.normcase(os.path.abspath(path))
51 51
52 def check_path(self, path):
53 """
54 if under the root directory, returns the full path
55 otherwise, returns None
56 """
57 path = self.normpath(path)
58 if path == self.directory or path.startswith(self.directory + os.path.sep):
59 return path
60
52 def index(self, directory): 61 def index(self, directory):
53 """ 62 """
54 generate a directory listing for a given directory 63 generate a directory listing for a given directory
55 """ 64 """
56 parts = ['<html><head><title>Simple Index</title></head><body>'] 65 parts = ['<html><head><title>Simple Index</title></head><body>']
67 # TODO method_not_allowed: Allow: GET, HEAD 76 # TODO method_not_allowed: Allow: GET, HEAD
68 path_info = request.path_info 77 path_info = request.path_info
69 if not path_info: 78 if not path_info:
70 response = exc.HTTPMovedPermanently(add_slash=True) 79 response = exc.HTTPMovedPermanently(add_slash=True)
71 return response(environ, start_response) 80 return response(environ, start_response)
72 full = self.normpath(os.path.join(self.directory, path_info.strip('/'))) 81 full = self.check_path(os.path.join(self.directory, path_info.strip('/')))
73 82
74 if not full.startswith(self.directory): 83 if full is None:
75 # Out of bounds 84 # Out of bounds
76 return exc.HTTPNotFound()(environ, start_response) 85 return exc.HTTPNotFound()(environ, start_response)
77 if not os.path.exists(full): 86 if not os.path.exists(full):
78 return exc.HTTPNotFound()(environ, start_response) 87 return exc.HTTPNotFound()(environ, start_response)
79 88