feat: restrict thumbnail path to upload directory to prevent directory traversal

Browse Source
This commit is contained in:
retoor 2024-12-03 20:54:58 +00:00
parent 458b98a870
commit 201a78c963
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/rupload/app.py
View File

@ -271,7 +271,7 @@ async def handle_upload(request: web.Request):
async def handle_thumbnail(request: web.Request):
path = request.match_info["path"]
safe_path = pathlib.Path(path)
safe_path = pathlib.Path(request.app.upload_path).joinpath(pathlib.Path(path.name))
if not safe_path.is_file():
return web.Response(status=400, text="Invalid file type.")