maya-chen/flask
1
0
Fork 0
forked from orbit-oss/flask
Code Pull requests Activity

Extra safety for safe_join. Does not look exploitable but better safe than sorry. Fixes #501

Browse source
This commit is contained in:
Armin Ronacher 2012-10-07 22:58:41 +02:00
parent f701f69947
commit 3afcbf160e
2 changed files with 9 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
flask/helpers.py
View file

@ -604,7 +604,9 @@ def safe_join(directory, filename):
for sep in _os_alt_seps:
if sep in filename:
raise NotFound()
if os.path.isabs(filename) or filename.startswith('../'):
if os.path.isabs(filename) or \
filename == '..' or \
filename.startswith('../'):
raise NotFound()
return os.path.join(directory, filename)