maya-chen/flask
1
0
Fork 0
forked from orbit-oss/flask
Code Pull requests Activity

fixed possible security problem in module branch

Browse source
This commit is contained in:
Armin Ronacher 2010-07-04 20:36:34 +02:00
parent f1cde5bbfc
commit 8945a97a42
2 changed files with 22 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
flask/helpers.py
View file

@ -29,6 +29,7 @@ except ImportError:
json_available = False
from werkzeug import Headers, wrap_file, is_resource_modified, cached_property
from werkzeug.exceptions import NotFound
from jinja2 import FileSystemLoader
@ -334,7 +335,7 @@ class _PackageBoundObject(object):
.. versionadded:: 0.5
"""
filename = posixpath.normpath(filename)
if filename.startswith('../'):
if filename.startswith(('/', '../')):
raise NotFound()
filename = os.path.join(self.root_path, 'static', filename)
if not os.path.isfile(filename):