ExternalVendorCode/tahoe-lafs
1
0
Fork 0
mirror of https://github.com/tahoe-lafs/tahoe-lafs.git synced 2025-01-17 10:20:13 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Reject URIs that contain empty segments

Browse Source
This commit is contained in:
Sajith Sasidharan 2020-05-29 19:47:12 -04:00
parent ae7802fc0c
commit 0633623ecc
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/allmydata/web/directory.py
View File

@ -106,6 +106,16 @@ class DirectoryNodeHandler(ReplaceMeMixin, Resource, object):
if not name: if not name:
return self return self
# Rejecting URIs that contain empty path pieces (for example:
# "/uri/URI:DIR2:../foo//new.txt" or "/uri/URI:DIR2:..//") was
# the old nevow behavior and it is encoded in the test suite;
# we will follow suit.
for segment in req.prepath:
if not segment:
raise EmptyPathnameComponentError(
u"The webapi does not allow empty pathname components",
)
name = name.decode('utf8') name = name.decode('utf8')
d = self.node.get(name) d = self.node.get(name)
d.addBoth(self._got_child, req, name) d.addBoth(self._got_child, req, name)