Differential D8945

api, browse: Ensure to sanitize filename passed to django FileResponse
ClosedPublic
Actions

Authored by anlambert on Dec 7 2022, 5:55 PM.

Details

Reviewers

vlorentz

Group Reviewers

Reviewers

Commits

rDWAPPS9a29da9ad689: api, browse: Ensure to sanitize filename passed to django FileResponse

Summary

Django might try to access the file if the value provided to the filename
query parameter of associated views is an absolute path.

Fixes SWH-WEBAPP-4B9

Diff Detail

Repository

rDWAPPS Web applications

Lint

Automatic diff as part of commit; lint not applicable.

Unit

Automatic diff as part of commit; unit tests not applicable.

Event Timeline

anlambert created this revision.Dec 7 2022, 5:55 PM

Herald added a reviewer: Reviewers. · View Herald TranscriptDec 7 2022, 5:55 PM

Build is green

Patch application report for D8945 (id=32222)

Rebasing onto 36ce2b462f...

Current branch diff-target is up to date.

Changes applied before test

commit 9a29da9ad68949a46a83828bcd4ea40a217d610e
Author: Antoine Lambert <anlambert@softwareheritage.org>
Date:   Wed Dec 7 17:53:56 2022 +0100

    api, browse: Ensure to sanitize filename passed to django FileResponse
    
    Django might try to access the file if the value provided to the filename
    query parameter of associated views is an absolute path.

See https://jenkins.softwareheritage.org/job/DWAPPS/job/tests-on-diff/51/ for more details.

Harbormaster completed remote builds in B33177: Diff 32222.Dec 7 2022, 6:06 PM

anlambert requested review of this revision.Dec 7 2022, 6:06 PM

vlorentz accepted this revision.Dec 8 2022, 2:29 AM

This revision is now accepted and ready to land.Dec 8 2022, 2:29 AM

Closed by commit rDWAPPS9a29da9ad689: api, browse: Ensure to sanitize filename passed to django FileResponse (authored by anlambert). · Explain WhyDec 8 2022, 5:21 PM

This revision was automatically updated to reflect the committed changes.

anlambert added a commit: rDWAPPS9a29da9ad689: api, browse: Ensure to sanitize filename passed to django FileResponse.