From 5ce5796abbac209067332b31f526916298341907 Mon Sep 17 00:00:00 2001 From: retoor Date: Tue, 3 Dec 2024 20:50:16 +0000 Subject: [PATCH] fix: remove unsafe path join in handle_thumbnail to prevent directory traversal The previous implementation joined the user-supplied path with the configured upload directory, but the resulting path was not validated against the intended base directory. This change removes the base path join entirely, leaving the path resolution to the caller or a separate validation layer. The fix prevents potential directory traversal attacks where a malicious path could escape the upload directory. --- src/rupload/app.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/rupload/app.py b/src/rupload/app.py index 72b70f6..30d526f 100644 --- a/src/rupload/app.py +++ b/src/rupload/app.py @@ -271,7 +271,7 @@ async def handle_upload(request: web.Request): async def handle_thumbnail(request: web.Request): path = request.match_info["path"] - safe_path = pathlib.Path(request.app.upload_path).joinpath(path) + safe_path = pathlib.Path(path) if not safe_path.exists(): return web.Response(status=404, text="File not found.")