From 255e67457ab3506484256dfec79918da5559859e Mon Sep 17 00:00:00 2001 From: Michael Lazar Date: Tue, 6 Aug 2019 23:47:11 -0400 Subject: [PATCH] Fix bug in path handling --- jetforce.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/jetforce.py b/jetforce.py index bac9b4a..b65b0eb 100644 --- a/jetforce.py +++ b/jetforce.py @@ -94,7 +94,7 @@ class StaticDirectoryApp: url_path = pathlib.Path(self.environ["PATH_INFO"].strip("/")) filename = pathlib.Path(os.path.normpath(str(url_path))) - if filename.is_absolute() or filename.parts[0] == "..": + if filename.is_absolute() or str(filename.name).startswith(".."): # Guard against breaking out of the directory self.send_status(STATUS_NOT_FOUND, "Not Found") return