waldek
/
jetforce
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'v0.2.3'

This commit is contained in:
Michael Lazar 2020-05-24 21:48:17 -04:00
parent e79bd79c92 524df0d56a
commit e5b1d5b41d
2 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
CHANGELOG.md
View File

@ -72,11 +72,16 @@ variable.
by combining multiple applications behind the same jetforce server. See by combining multiple applications behind the same jetforce server. See
examples/vhost.py for an example of how to use this class. examples/vhost.py for an example of how to use this class.
### v0.2.2 (2012-03-31) ### v0.2.3 (2020-05-24)
- Fix a security vulnerability that allowed maliciously crafted URLs to break
out of the root server directory.
### v0.2.2 (2020-03-31)
- Fix a regression in path matching for the static directory application. - Fix a regression in path matching for the static directory application.
### v0.2.1 (2012-03-31) ### v0.2.1 (2020-03-31)
- A hostname can now be specified in the route pattern, to facilitate running - A hostname can now be specified in the route pattern, to facilitate running
multiple vhosts on a single jetforce server. multiple vhosts on a single jetforce server.
@ -87,7 +92,7 @@ variable.
- Added the following CGI variables for client certificates: - Added the following CGI variables for client certificates:
TLS_CLIENT_NOT_BEFORE, TLS_CLIENT_NOT_AFTER, TLS_CLIENT_SERIAL_NUMBER TLS_CLIENT_NOT_BEFORE, TLS_CLIENT_NOT_AFTER, TLS_CLIENT_SERIAL_NUMBER
### v0.2.0 (2012-01-21) ### v0.2.0 (2020-01-21)
#### Features #### Features

2
jetforce/app/static.py
View File

@ -48,7 +48,7 @@ class StaticDirectoryApplication(JetforceApplication):
url_path = pathlib.Path(request.path.strip("/")) url_path = pathlib.Path(request.path.strip("/"))
filename = pathlib.Path(os.path.normpath(str(url_path))) filename = pathlib.Path(os.path.normpath(str(url_path)))
if filename.is_absolute() or str(filename.name).startswith(".."): if filename.is_absolute() or str(filename).startswith(".."):
# Guard against breaking out of the directory # Guard against breaking out of the directory
return Response(Status.NOT_FOUND, "Not Found") return Response(Status.NOT_FOUND, "Not Found")