Grasscutters/mitmproxy
3
0
Fork 0
mirror of https://github.com/Grasscutters/mitmproxy.git synced 2025-02-01 07:49:10 +00:00
Code Issues Projects Releases Wiki Activity

Constrain file access to configured directory in pathod.

Browse Source
This commit is contained in:
Aldo Cortesi 2012-07-22 23:46:56 +12:00
parent 1b03fd6780
commit 96db3557ce
2 changed files with 15 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
libpathod/rparse.py
View File

@ -243,13 +243,19 @@ class ValueFile:
return e.setParseAction(lambda x: klass(*x)) return e.setParseAction(lambda x: klass(*x))
def get_generator(self, settings): def get_generator(self, settings):
uf = settings.get("unconstrained_file_access")
sd = settings.get("staticdir") sd = settings.get("staticdir")
if not sd: if not sd:
raise ServerError("No static directory specified.") raise ServerError("File access disabled.")
path = os.path.join(sd, self.path) sd = os.path.normpath(os.path.abspath(sd))
if not os.path.exists(path):
raise ServerError("Static file does not exist: %s"%path) s = os.path.expanduser(self.path)
return FileGenerator(path) s = os.path.normpath(os.path.abspath(os.path.join(sd, s)))
if not uf and not s.startswith(sd):
raise ServerError("File access outside of configured directory")
if not os.path.isfile(s):
raise ServerError("File not readable")
return FileGenerator(s)
def __str__(self): def __str__(self):
return "<%s"%(self.path) return "<%s"%(self.path)

6
test/test_rparse.py
View File

@ -70,7 +70,10 @@ class TestMisc:
v = rparse.Value.parseString("<path2")[0] v = rparse.Value.parseString("<path2")[0]
tutils.raises(rparse.ServerError, v.get_generator, dict(staticdir=t)) tutils.raises(rparse.ServerError, v.get_generator, dict(staticdir=t))
tutils.raises("no static directory", v.get_generator, dict()) tutils.raises("access disabled", v.get_generator, dict())
v = rparse.Value.parseString("</outside")[0]
tutils.raises("outside", v.get_generator, dict(staticdir=t))
def test_generated_value(self): def test_generated_value(self):
v = rparse.Value.parseString("@10b")[0] v = rparse.Value.parseString("@10b")[0]
@ -431,7 +434,6 @@ class TestResponse:
testlen(rparse.parse_response({}, "400'msg':h'foo'='bar':b@100b")) testlen(rparse.parse_response({}, "400'msg':h'foo'='bar':b@100b"))
def test_read_file(): def test_read_file():
tutils.raises(rparse.FileAccessDenied, rparse.read_file, {}, "=/foo") tutils.raises(rparse.FileAccessDenied, rparse.read_file, {}, "=/foo")
p = tutils.test_data.path("data") p = tutils.test_data.path("data")