| |
@@ -25,6 +25,7 @@
|
| |
import flask
|
| |
import pygit2
|
| |
import werkzeug.datastructures
|
| |
+ import werkzeug.security
|
| |
from binaryornot.helpers import is_binary_string
|
| |
from six.moves.urllib.parse import urljoin
|
| |
from sqlalchemy.exc import SQLAlchemyError
|
| |
@@ -1483,7 +1484,10 @@
|
| |
attachdir = os.path.join(
|
| |
pagure_config["ATTACHMENTS_FOLDER"], repo.fullname
|
| |
)
|
| |
- attachpath = os.path.join(attachdir, filename)
|
| |
+
|
| |
+ # sanitize path, filename must be inside attachdir to be valid
|
| |
+ attachpath = werkzeug.security.safe_join(attachdir, filename)
|
| |
+
|
| |
if not os.path.exists(attachpath):
|
| |
if not os.path.exists(attachdir):
|
| |
os.makedirs(attachdir)
|
| |
wombelix
commented a year ago
Use 'werkzeug.security.safe_join()' instead of plain 'os.path.join()'
to sanitize user-provided filename variable and avoid escaping the base directory.
Vulnerability discovered by Thomas Chauchefoin thomas@chauchefoin.fr
Fixes: rhbz#2279411, rhbz#2280728, rhbz#2280726, CVE-2024-4982
Signed-off-by: Dominik Wombacher dominik@wombacher.cc