From b1294fa49f3a53981e8a194d3d2797be7a7714a0 Mon Sep 17 00:00:00 2001 From: m957ymj75urz Date: Tue, 14 Mar 2023 09:27:17 +0100 Subject: [PATCH] fix path traversal for /view --- server.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/server.py b/server.py index 05d1af04..be2fc056 100644 --- a/server.py +++ b/server.py @@ -118,11 +118,15 @@ class PromptServer(): output_dir = os.path.join(os.path.dirname(os.path.realpath(__file__)), type) if "subfolder" in request.rel_url.query: - output_dir = os.path.join(output_dir, request.rel_url.query["subfolder"]) + full_output_dir = os.path.join(output_dir, request.rel_url.query["subfolder"]) + if os.path.commonpath((os.path.realpath(full_output_dir), output_dir)) != output_dir: + return web.Response(status=403) + output_dir = full_output_dir file = request.rel_url.query["file"] file = os.path.basename(file) file = os.path.join(output_dir, file) + if os.path.isfile(file): return web.FileResponse(file)