Leahnaya/dwc_network_server_emulator
1
0
Fork 0
mirror of https://github.com/barronwaffles/dwc_network_server_emulator.git synced 2026-08-27 13:24:03 -05:00
Code Issues Actions Packages Projects Releases Wiki Activity

NAS: Prevent download path attack.

Browse Source
This commit is contained in:
Admiral H. Curtiss
2014-05-27 15:01:59 +02:00
parent e7ff9e5a67
commit c6cb8d0f6f
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
nas_server.py
View File

@@ -149,8 +149,14 @@ class NasHTTPServerHandler(BaseHTTPServer.BaseHTTPRequestHandler):
action = post["action"]
ret = ""
dlcpath = "dlc/" + post["gamecd"]
dlcdir = os.path.abspath('dlc')
dlcpath = os.path.abspath("dlc/" + post["gamecd"])
dlc_contenttype = False
if os.path.commonprefix([dlcdir, dlcpath]) != dlcdir:
logging.log(logging.WARNING, 'Attempted directory traversal attack "%s", cancelling.', dlcpath)
self.send_response(403)
return
def safeloadfi(fn, mode='rb'):
'''