Richard/eirescope
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

fix path traversal in /static/ handler

Browse source 
`_serve_static` joined the URL-supplied filepath directly into STATIC_DIR
without normalising `..` segments or rejecting absolute paths, allowing
arbitrary file read on the host. Resolve both sides to realpaths and
require the result to live under STATIC_DIR.
This commit is contained in:
authentik Default Admin 2026-05-08 17:59:19 +00:00
parent 0eb17a3b37
commit 3365e0b23e
1 changed files with 6 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

7
eirescope/web/app.py
View file

@ -207,7 +207,12 @@ class EireScopeHandler(BaseHTTPRequestHandler):
def _serve_static(self, filepath: str):
"""Serve static files (CSS, JS, images)."""
full_path = os.path.join(STATIC_DIR, filepath)
# Confine to STATIC_DIR — `..` segments and absolute paths can escape os.path.join.
static_root = os.path.realpath(STATIC_DIR)
full_path = os.path.realpath(os.path.join(static_root, filepath))
if full_path != static_root and not full_path.startswith(static_root + os.sep):
self._send_error(403, "Forbidden")
return
if not os.path.isfile(full_path):
self._send_error(404, "File not found")
return