|
1 | 1 | import os.path |
| 2 | +from flask import Flask, request, abort |
2 | 3 |
|
| 4 | +app = Flask(__name__) |
3 | 5 |
|
4 | | -urlpatterns = [ |
5 | | - # Route to user_picture |
6 | | - url(r'^user-pic1$', user_picture1, name='user-picture1'), |
7 | | - url(r'^user-pic2$', user_picture2, name='user-picture2'), |
8 | | - url(r'^user-pic3$', user_picture3, name='user-picture3') |
9 | | -] |
10 | | - |
11 | | - |
12 | | -def user_picture1(request): |
13 | | - """A view that is vulnerable to malicious file access.""" |
14 | | - filename = request.GET.get('p') |
| 6 | +@app.route("/user_picture1") |
| 7 | +def user_picture1(): |
| 8 | + filename = request.args.get('p') |
15 | 9 | # BAD: This could read any file on the file system |
16 | 10 | data = open(filename, 'rb').read() |
17 | | - return HttpResponse(data) |
| 11 | + return data |
18 | 12 |
|
19 | | -def user_picture2(request): |
20 | | - """A view that is vulnerable to malicious file access.""" |
| 13 | +@app.route("/user_picture2") |
| 14 | +def user_picture2(): |
21 | 15 | base_path = '/server/static/images' |
22 | | - filename = request.GET.get('p') |
| 16 | + filename = request.args.get('p') |
23 | 17 | # BAD: This could still read any file on the file system |
24 | 18 | data = open(os.path.join(base_path, filename), 'rb').read() |
25 | | - return HttpResponse(data) |
| 19 | + return data |
26 | 20 |
|
27 | | -def user_picture3(request): |
28 | | - """A view that is not vulnerable to malicious file access.""" |
| 21 | +@app.route("/user_picture3") |
| 22 | +def user_picture3(): |
29 | 23 | base_path = '/server/static/images' |
30 | | - filename = request.GET.get('p') |
| 24 | + filename = request.args.get('p') |
31 | 25 | #GOOD -- Verify with normalised version of path |
32 | 26 | fullpath = os.path.normpath(os.path.join(base_path, filename)) |
33 | 27 | if not fullpath.startswith(base_path): |
34 | | - raise SecurityException() |
| 28 | + raise Exception("not allowed") |
35 | 29 | data = open(fullpath, 'rb').read() |
36 | | - return HttpResponse(data) |
| 30 | + return data |
0 commit comments