Browse Source
Potential fix for pull request finding 'CodeQL / Uncontrolled data used in path expression'
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
pull/3865/head
Edward
3 weeks ago
committed by
GitHub
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with
6 additions and
2 deletions
-
sapl/base/media.py
|
|
@ -95,10 +95,14 @@ def media(request, path): |
|
|
|
|
|
|
|
|
if settings.DEBUG: |
|
|
if settings.DEBUG: |
|
|
try: |
|
|
try: |
|
|
|
|
|
media_root = os.path.realpath(settings.MEDIA_ROOT) |
|
|
|
|
|
caminho = os.path.realpath(os.path.join(media_root, nome)) |
|
|
|
|
|
if os.path.commonpath([media_root, caminho]) != media_root: |
|
|
|
|
|
raise Http404 |
|
|
response = FileResponse( |
|
|
response = FileResponse( |
|
|
open(os.path.join(settings.MEDIA_ROOT, nome), 'rb'), |
|
|
open(caminho, 'rb'), |
|
|
content_type=content_type) |
|
|
content_type=content_type) |
|
|
except (FileNotFoundError, IsADirectoryError): |
|
|
except (FileNotFoundError, IsADirectoryError, ValueError): |
|
|
raise Http404 |
|
|
raise Http404 |
|
|
else: |
|
|
else: |
|
|
response = HttpResponse(content_type=content_type) |
|
|
response = HttpResponse(content_type=content_type) |
|
|
|
