Allow symlinked folder within root directory (#4863)

This commit is contained in:
Bartowski 2023-12-13 16:08:21 -05:00 committed by GitHub
parent 36e850fe89
commit f51156705d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

View File

@ -21,16 +21,17 @@ def save_file(fname, contents):
return return
root_folder = Path(__file__).resolve().parent.parent root_folder = Path(__file__).resolve().parent.parent
abs_path = Path(fname).resolve() abs_path_str = os.path.abspath(fname)
rel_path = abs_path.relative_to(root_folder) rel_path_str = os.path.relpath(abs_path_str, root_folder)
rel_path = Path(rel_path_str)
if rel_path.parts[0] == '..': if rel_path.parts[0] == '..':
logger.error(f'Invalid file path: {fname}') logger.error(f'Invalid file path: {fname}')
return return
with open(abs_path, 'w', encoding='utf-8') as f: with open(abs_path_str, 'w', encoding='utf-8') as f:
f.write(contents) f.write(contents)
logger.info(f'Saved {abs_path}.') logger.info(f'Saved {abs_path_str}.')
def delete_file(fname): def delete_file(fname):
@ -39,8 +40,9 @@ def delete_file(fname):
return return
root_folder = Path(__file__).resolve().parent.parent root_folder = Path(__file__).resolve().parent.parent
abs_path = Path(fname).resolve() abs_path_str = os.path.abspath(fname)
rel_path = abs_path.relative_to(root_folder) rel_path_str = os.path.relpath(abs_path_str, root_folder)
rel_path = Path(rel_path_str)
if rel_path.parts[0] == '..': if rel_path.parts[0] == '..':
logger.error(f'Invalid file path: {fname}') logger.error(f'Invalid file path: {fname}')
return return