Leahnaya/bemaniutils
1
0
Fork 0
mirror of https://github.com/DragonMinded/bemaniutils.git synced 2026-06-03 06:24:16 -05:00
Code Issues Actions Packages Projects Releases Wiki Activity

frontend: Patch path traversal vulnerability

Browse Source
This commit is contained in:
seth 2021-07-06 15:37:22 -05:00 committed by Jennifer Taylor
parent 33d0000c77
commit f0792067b7
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
bemani/frontend/app.py
View File

@ -130,6 +130,10 @@ def cacheable(max_age: int) -> Callable:
def jsx(filename: str) -> Response:
# Figure out what our update time is to namespace on
jsxfile = os.path.join(static_location, filename)
normalized_path = os.path.normpath(jsxfile)
# Check for path traversal exploit
if not normalized_path.startswith(static_location):
raise IOError()
mtime = os.path.getmtime(jsxfile)
namespace = f'{mtime}.{jsxfile}'
jsx = g.cache.get(namespace)