Clean files and catch file path escape. Ref #1894

gns3server/api/routes/controller/nodes.py

@@ -305,11 +305,11 @@ async def get_file(file_path: str, node: Node = Depends(dep_node)) -> Response:
     path = f"/project-files/{node_type}/{node.id}/{path}"
 
     res = await node.compute.http_query("GET", f"/projects/{node.project.id}/files{path}", timeout=None, raw=True)
-    return Response(res.body, media_type="application/octet-stream")
+    return Response(res.body, media_type="application/octet-stream", status_code=res.status)
 
 
 @router.post("/{node_id}/files/{file_path:path}", status_code=status.HTTP_201_CREATED)
-async def post_file(file_path: str, request: Request, node: Node = Depends(dep_node)) -> dict:
+async def post_file(file_path: str, request: Request, node: Node = Depends(dep_node)):
     """
     Write a file in the node directory.
     """
@@ -324,8 +324,8 @@ async def post_file(file_path: str, request: Request, node: Node = Depends(dep_n
     path = f"/project-files/{node_type}/{node.id}/{path}"
 
     data = await request.body()  # FIXME: are we handling timeout or large files correctly?
-
     await node.compute.http_query("POST", f"/projects/{node.project.id}/files{path}", data=data, timeout=None, raw=True)
+    # FIXME: response with correct status code (from compute)
 
 
 @router.websocket("/{node_id}/console/ws")

gns3server/api/routes/controller/projects.py

@@ -44,6 +44,7 @@ from gns3server.controller.controller_error import ControllerError, ControllerFo
 from gns3server.controller.import_project import import_project as import_controller_project
 from gns3server.controller.export_project import export_project as export_controller_project
 from gns3server.utils.asyncio import aiozipstream
+from gns3server.utils.path import is_safe_path
 from gns3server.config import Config
 
 responses = {404: {"model": schemas.ErrorMessage, "description": "Could not find project"}}
@@ -371,7 +372,7 @@ async def get_file(file_path: str, project: Project = Depends(dep_project)) -> F
     path = os.path.normpath(file_path).strip("/")
 
     # Raise error if user try to escape
-    if path[0] == ".":
+    if not is_safe_path(path, project.path):
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN)
 
     path = os.path.join(project.path, path)
@@ -390,7 +391,7 @@ async def write_file(file_path: str, request: Request, project: Project = Depend
     path = os.path.normpath(file_path).strip("/")
 
     # Raise error if user try to escape
-    if path[0] == ".":
+    if not is_safe_path(path, project.path):
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN)
 
     path = os.path.join(project.path, path)