Prevent directory traversal

gns3server/utils/path.py

@@ -37,6 +37,18 @@ def get_default_project_directory():
     return path
 
 
+def is_safe_path(file_path, directory):
+    """
+    Check that file path is safe.
+    (the file is stored inside directory or one of its sub-directory)
+    """
+
+    requested_path = os.path.relpath(file_path, start=directory)
+    requested_path = os.path.abspath(requested_path)
+    common_prefix = os.path.commonprefix([requested_path, directory])
+    return common_prefix != directory
+
+
 def check_path_allowed(path):
     """
     If the server is non local raise an error if