NgTech-LTD/gns3-server
2
0
Fork 0
mirror of https://github.com/GNS3/gns3-server.git synced 2026-09-28 14:50:14 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2630 from UmmmAGoodName/3.0

Browse Source 
Fixed the path traversal check
This commit is contained in:
Jeremy Grossmann 2026-03-06 18:05:57 +08:00 committed by GitHub
commit 5755a48fa3
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
gns3server/api/routes/index.py
View File

@ -46,8 +46,8 @@ async def web_ui(file_path: str):
file_path = os.path.normpath(file_path).strip("/") file_path = os.path.normpath(file_path).strip("/")
file_path = os.path.join("static", "web-ui", file_path) file_path = os.path.join("static", "web-ui", file_path)
# Raise error if user try to escape # Raise error if user tries to escape the web-ui directory
if file_path[0] == ".": if not os.path.normpath(file_path).startswith(os.path.join("static", "web-ui")):
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN) raise HTTPException(status_code=status.HTTP_403_FORBIDDEN)
static = get_resource(file_path) static = get_resource(file_path)