Commit dc5bb4f
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1,36 +1,30 @@ | |||
| 1 | 1 | import os.path | |
| 2 | + from flask import Flask, request, abort | ||
| 2 | 3 | ||
| 4 | + app = Flask(__name__) | ||
| 3 | 5 | ||
| 4 | - urlpatterns = [ | ||
| 5 | - # Route to user_picture | ||
| 6 | - url(r'^user-pic1$', user_picture1, name='user-picture1'), | ||
| 7 | - url(r'^user-pic2$', user_picture2, name='user-picture2'), | ||
| 8 | - url(r'^user-pic3$', user_picture3, name='user-picture3') | ||
| 9 | - ] | ||
| 10 | - | ||
| 11 | - | ||
| 12 | - def user_picture1(request): | ||
| 13 | - """A view that is vulnerable to malicious file access.""" | ||
| 14 | - filename = request.GET.get('p') | ||
| 6 | + @app.route("/user_picture1") | ||
| 7 | + def user_picture1(): | ||
| 8 | + filename = request.args.get('p') | ||
| 15 | 9 | # BAD: This could read any file on the file system | |
| 16 | 10 | data = open(filename, 'rb').read() | |
| 17 | - return HttpResponse(data) | ||
| 11 | + return data | ||
| 18 | 12 | ||
| 19 | - def user_picture2(request): | ||
| 20 | - """A view that is vulnerable to malicious file access.""" | ||
| 13 | + @app.route("/user_picture2") | ||
| 14 | + def user_picture2(): | ||
| 21 | 15 | base_path = '/server/static/images' | |
| 22 | - filename = request.GET.get('p') | ||
| 16 | + filename = request.args.get('p') | ||
| 23 | 17 | # BAD: This could still read any file on the file system | |
| 24 | 18 | data = open(os.path.join(base_path, filename), 'rb').read() | |
| 25 | - return HttpResponse(data) | ||
| 19 | + return data | ||
| 26 | 20 | ||
| 27 | - def user_picture3(request): | ||
| 28 | - """A view that is not vulnerable to malicious file access.""" | ||
| 21 | + @app.route("/user_picture3") | ||
| 22 | + def user_picture3(): | ||
| 29 | 23 | base_path = '/server/static/images' | |
| 30 | - filename = request.GET.get('p') | ||
| 24 | + filename = request.args.get('p') | ||
| 31 | 25 | #GOOD -- Verify with normalised version of path | |
| 32 | 26 | fullpath = os.path.normpath(os.path.join(base_path, filename)) | |
| 33 | 27 | if not fullpath.startswith(base_path): | |
| 34 | - raise SecurityException() | ||
| 28 | + raise Exception("not allowed") | ||
| 35 | 29 | data = open(fullpath, 'rb').read() | |
| 36 | - return HttpResponse(data) | ||
| 30 | + return data | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1,7 +1,7 @@ | |||
| 1 | - | ||
| 1 | + import sys | ||
| 2 | 2 | import tarfile | |
| 3 | 3 | ||
| 4 | - with tarfile.open('archive.zip') as tar: | ||
| 4 | + with tarfile.open(sys.argv[1]) as tar: | ||
| 5 | 5 | #BAD : This could write any file on the filesystem. | |
| 6 | 6 | for entry in tar: | |
| 7 | 7 | tar.extract(entry, "/tmp/unpack/") | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1,8 +1,8 @@ | |||
| 1 | - | ||
| 1 | + import sys | ||
| 2 | 2 | import tarfile | |
| 3 | 3 | import os.path | |
| 4 | 4 | ||
| 5 | - with tarfile.open('archive.zip') as tar: | ||
| 5 | + with tarfile.open(sys.argv[1]) as tar: | ||
| 6 | 6 | for entry in tar: | |
| 7 | 7 | #GOOD: Check that entry is safe | |
| 8 | 8 | if os.path.isabs(entry.name) or ".." in entry.name: | |
0 commit comments