oss/Radicale
oss/Radicale
1
0
Fork 0
mirror of https://github.com/Kozea/Radicale.git synced 2025-08-28 19:40:54 +00:00
Code Wiki Activity

Prevent unsafe usernames

Browse source 
If an attacker is able to create an account with a username like "user/calendar.ics", he can access collections of other users.
This commit is contained in:
Unrud 2016-08-01 09:10:23 +02:00
parent f4ebe3f545
commit da1a693620
3 changed files with 20 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
radicale/storage.py
View file

@ -103,6 +103,15 @@ def get_etag(text):
return '"%s"' % etag.hexdigest()
def is_safe_path_component(path):
"""Check if path is a single component of a path.
Check that the path is safe to join too.
"""
return path and "/" not in path and path not in (".", "..")
def sanitize_path(path):
"""Make path absolute with leading slash to prevent access to other data.