Change method to prevent forbidden directory traversal. Ref #1894

gns3server/api/routes/compute/projects.py

@@ -19,6 +19,7 @@ API routes for projects.
 """
 
 import os
+import urllib.parse
 
 import logging
 
@@ -198,6 +199,7 @@ async def get_compute_project_file(file_path: str, project: Project = Depends(de
     Get a file from a project.
     """
 
+    file_path = urllib.parse.unquote(file_path)
     path = os.path.normpath(file_path)
 
     # Raise error if user try to escape
@@ -214,6 +216,7 @@ async def get_compute_project_file(file_path: str, project: Project = Depends(de
 @router.post("/projects/{project_id}/files/{file_path:path}", status_code=status.HTTP_204_NO_CONTENT)
 async def write_compute_project_file(file_path: str, request: Request, project: Project = Depends(dep_project)) -> None:
 
+    file_path = urllib.parse.unquote(file_path)
     path = os.path.normpath(file_path)
 
     # Raise error if user try to escape