From e5e6bda4f014f807ca77ee0cf6af777a55918346 Mon Sep 17 00:00:00 2001 From: Dannon Baker Date: Mon, 5 Dec 2022 14:35:56 -0500 Subject: [PATCH] Contain directory traversal for static files to host static root. --- lib/galaxy/web/framework/middleware/static.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/lib/galaxy/web/framework/middleware/static.py b/lib/galaxy/web/framework/middleware/static.py index fcc878f16ff..50a94faf258 100644 --- a/lib/galaxy/web/framework/middleware/static.py +++ b/lib/galaxy/web/framework/middleware/static.py @@ -38,7 +38,11 @@ class CacheableStaticURLParser(StaticURLParser): directory = host_val break - full = os.path.join(directory, filename) + full = self.normpath(os.path.join(directory, filename)) + if not full.startswith(directory): + # Out of bounds + return self.not_found(environ, start_response) + if not os.path.exists(full): return self.not_found(environ, start_response) if os.path.isdir(full):