[tryton-commits] changeset in trytond:5.0 Use safe_join in SharedDataMiddlewareIndex

[Cédric Krier]

changeset b210cd3452af in trytond:5.0
details: https://hg.tryton.org/trytond?cmd=changeset;node=b210cd3452af
description:
        Use safe_join in SharedDataMiddlewareIndex

        issue10068
        review333851027
        (grafted from bdea3f9af35fd8305363384a504f0ad2aade5474)
diffstat:

 CHANGELOG       |   2 ++
 trytond/wsgi.py |  17 ++++++++++++-----
 2 files changed, 14 insertions(+), 5 deletions(-)

diffs (52 lines):

diff -r 6fbe0a887294 -r b210cd3452af CHANGELOG
--- a/CHANGELOG Mon Feb 01 22:51:13 2021 +0100
+++ b/CHANGELOG Fri Feb 12 10:01:22 2021 +0100
@@ -1,3 +1,5 @@
+* Use safe_join in SharedDataMiddlewareIndex (issue10068)
+
 Version 5.0.32 - 2021-02-01
 * Bug fixes (see mercurial logs for details)
 
diff -r 6fbe0a887294 -r b210cd3452af trytond/wsgi.py
--- a/trytond/wsgi.py   Mon Feb 01 22:51:13 2021 +0100
+++ b/trytond/wsgi.py   Fri Feb 12 10:01:22 2021 +0100
@@ -3,6 +3,7 @@
 import http.client
 import logging
 import os
+import posixpath
 import sys
 import traceback
 
@@ -10,6 +11,11 @@
 from werkzeug.routing import Map, Rule
 from werkzeug.exceptions import abort, HTTPException, InternalServerError
 from werkzeug.contrib.fixers import ProxyFix
+try:
+    from werkzeug.security import safe_join
+except ImportError:
+    safe_join = posixpath.join
+
 from werkzeug.wsgi import SharedDataMiddleware
 
 import wrapt
@@ -131,13 +137,14 @@
     def get_directory_loader(self, directory):
         def loader(path):
             if path is not None:
-                path = os.path.join(directory, path)
+                path = safe_join(directory, path)
             else:
                 path = directory
-            if os.path.isdir(path):
-                path = os.path.join(path, 'index.html')
-            if os.path.isfile(path):
-                return os.path.basename(path), self._opener(path)
+            if path is not None:
+                if os.path.isdir(path):
+                    path = posixpath.join(path, 'index.html')
+                if os.path.isfile(path):
+                    return os.path.basename(path), self._opener(path)
             return None, None
         return loader