hueta

services/rusgram/static/static.py

@@ -1,27 +1,35 @@
 #!/usr/bin/python3
-from flask import Flask, send_file
+from flask import Flask, send_file, abort
+import os
 app = Flask(__name__)
 static_node_port = 5001
 
 
+def safe_name(name):
+    # <name> normally has no slashes, but %2f / .. still show up decoded.
+    if not name or name != os.path.basename(name) or ".." in name or "\x00" in name:
+        abort(404)
+    return name
+
+
 @app.route('/img/<name>')
 def img(name):
-    return send_file(f'files/static/img/{name}')
+    return send_file(f'files/static/img/{safe_name(name)}')
 
 
 @app.route('/css/<name>')
 def css(name):
-    return send_file(f'files/static/css/{name}')
+    return send_file(f'files/static/css/{safe_name(name)}')
 
 
 @app.route('/fonts/<name>')
 def fonts(name):
-    return send_file(f'files/static/fonts/{name}')
+    return send_file(f'files/static/fonts/{safe_name(name)}')
 
 
 @app.route('/js/<name>')
 def js(name):
-    return send_file(f'files/static/js/{name}')
+    return send_file(f'files/static/js/{safe_name(name)}')
 
 
 if __name__ == '__main__':