xCAT/confluent
2
0
Fork 0
mirror of https://github.com/xcat2/confluent.git synced 2026-07-13 17:38:20 +00:00
Code Issues Projects Releases Wiki Activity

Prevent staging of files from indicating path traversal

Browse Source
This commit is contained in:
Jarrod Johnson
2026-06-25 10:09:28 -04:00
parent 46fbc11a93
commit d59652e0fd
1 changed files with 10 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
confluent_server/confluent/core.py
+10 -11
View File
@@ -1411,17 +1411,16 @@ async def handle_staging(pathcomponents, operation, configmanager, inputdata):
'''
if operation == 'create':
if len(pathcomponents) == 1:
stage = Staging(inputdata['user'],str(uuid.uuid1()))
if stage.create_directory():
if 'filename' in inputdata:
data_file = stage.storage_folder + '/filename.txt'
with open(data_file, 'w') as f:
f.write(inputdata['filename'])
else:
raise Exception('Error: Missing filename arg')
push_url = stage.get_push_url()
yield msg.CreatedResource(push_url)
if 'filename' not in inputdata:
raise Exception('Error: Missing filename parameter')
inputdata['filename'] = os.path.normpath(inputdata['filename'])
if '/' in inputdata['filename'] or '\\' in inputdata['filename']:
raise Exception('Error: Invalid filename parameter, must not contain path separators')
stage = Staging(inputdata['user'],str(uuid.uuid4()))
if stage.create_directory():
data_file = stage.storage_folder + '/filename.txt'
push_url = stage.get_push_url()
yield msg.CreatedResource(push_url)
elif len(pathcomponents) == 3:
stage = Staging(pathcomponents[1], pathcomponents[2])
file = stage.get_file_name()