ExternalVendorCode/gns3-server
1
0
Fork 0
mirror of https://github.com/GNS3/gns3-server.git synced 2025-06-21 16:39:40 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Prevent directory traversal

Browse Source
This commit is contained in:
grossmj
2021-05-15 17:35:32 +09:30
parent 2c938b2c19
commit 6294ad9e76
9 changed files with 70 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
gns3server/handlers/api/compute/qemu_handler.py
View File

@ -566,15 +566,15 @@ class QEMUHandler:
raw=True,
description="Download Qemu image")
async def download_image(request, response):
filename = request.match_info["filename"]
# Raise error if user try to escape
if filename[0] == "." or os.path.sep in filename:
raise aiohttp.web.HTTPForbidden()
qemu_manager = Qemu.instance()
image_path = qemu_manager.get_abs_image_path(filename)
# Raise error if user try to escape
if filename[0] == ".":
raise aiohttp.web.HTTPForbidden()
await response.stream_file(image_path)
@Route.get(