CODEWITHSUNDEEP
pythonweb
chmike
chmike

Reputation: 22174

Is it enough to test for '/../' in a file path to prevent escaping a subdirectory?

I have some code in python that checks that a file path access a file in a subdirectory. It is for a web server to access files in the static folder.

I use the following code snippet :

path = 'static/' + path
try:
    if '/../' in path:
        raise RuntimeError('/../ in static file path')
    f = open(path)
except (RuntimeError, IOError):
    app.abort(404)
    return

If the path is clean it would be enough.

Could there be ways to write a path accessing parent directories that would not be detected by this simple test ?

Upvotes: 1

Views: 150

Answers (3)

Dunes
Dunes

Reputation: 40763

I would suggest using os.path.relpath, it takes a path and works out the most concise relative path from the given directory. That way you only need to test if the path starts with ".."

eg.

path = ...
relativePath = os.path.relpath(path)
if relativePath.startswith(".."):
    raise RuntimeError("path escapes static directory")
completePath = "static/" + relativePath

You could also use os.readlink to replace symbolic links with a real path if sym links are something you have to worry about.

Upvotes: 2

user723556
user723556

Reputation: 

..//

This essentially is the same thing, however since you are straight away matching strings for /../ the, one I added would go undetected and would get the parent directory.

Upvotes: 0

Blender
Blender

Reputation: 298392

Flask has a few helper functions that I think you can copy over to your code without problems. The recommended syntax is:

filename = secure_filename(dirty_filename)
path = os.path.join(upload_folder, filename)

Werkzeug implements secure_filename and uses this code to clean filenames:

_filename_ascii_strip_re = re.compile(r'[^A-Za-z0-9_.-]')    
_windows_device_files = ('CON', 'AUX', 'COM1', 'COM2', 'COM3', 'COM4', 'LPT1',
                         'LPT2', 'LPT3', 'PRN', 'NUL')

def secure_filename(filename):
    r"""Pass it a filename and it will return a secure version of it.  This
    filename can then safely be stored on a regular file system and passed
    to :func:`os.path.join`.  The filename returned is an ASCII only string
    for maximum portability.

    On windows system the function also makes sure that the file is not
    named after one of the special device files.

    >>> secure_filename("My cool movie.mov")
    'My_cool_movie.mov'
    >>> secure_filename("../../../etc/passwd")
    'etc_passwd'
    >>> secure_filename(u'i contain cool \xfcml\xe4uts.txt')
    'i_contain_cool_umlauts.txt'

    The function might return an empty filename.  It's your responsibility
    to ensure that the filename is unique and that you generate random
    filename if the function returned an empty one.

    .. versionadded:: 0.5

    :param filename: the filename to secure
    """
    if isinstance(filename, unicode):
        from unicodedata import normalize
        filename = normalize('NFKD', filename).encode('ascii', 'ignore')
    for sep in os.path.sep, os.path.altsep:
        if sep:
            filename = filename.replace(sep, ' ')
    filename = str(_filename_ascii_strip_re.sub('', '_'.join(
                   filename.split()))).strip('._')

    # on nt a couple of special files are present in each folder.  We
    # have to ensure that the target file is not such a filename.  In
    # this case we prepend an underline
    if os.name == 'nt' and filename and \
       filename.split('.')[0].upper() in _windows_device_files:
        filename = '_' + filename

    return filename

Upvotes: 1

Related Questions