feat: fix path traversal in thumbnail handler by using path.name on full path string

Browse Source
This commit is contained in:
retoor 2024-12-03 21:01:57 +00:00
parent 1747045941
commit 879a42039d
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/rupload/app.py
View File

@ -271,7 +271,7 @@ async def handle_upload(request: web.Request):
async def handle_thumbnail(request: web.Request):
path = request.match_info["path"]
safe_path = pathlib.Path(request.app.upload_path).joinpath(pathlib.Path(path.name))
safe_path = pathlib.Path(request.app.upload_path).joinpath(pathlib.Path(path).name)
if not safe_path.is_file():
return web.Response(status=400, text="Invalid file type.")