This change disables up-level references beyond the HTTP base directory.
[CVE-2020-1699]
Fixes: https://tracker.ceph.com/issues/43607
Signed-off-by: Ernesto Puerta <epuertat@redhat.com>
(cherry picked from commit
0443e40c11280ba3b7efcba61522afa70c4f8158)
Conflicts:
- src/pybind/mgr/dashboard/tests/test_home.py (refactored tests)
base_dir = self._language_dir(langs)
full_path = os.path.join(base_dir, path)
+
+ # Block uplevel attacks
+ if not os.path.normpath(full_path).startswith(os.path.normpath(base_dir)):
+ raise cherrypy.HTTPError(403) # Forbidden
+
logger.debug("serving static content: %s", full_path)
if 'Vary' in cherrypy.response.headers:
cherrypy.response.headers['Vary'] = "{}, Accept-Language"
logger.info(self.body)
self.assertIn('<html lang="en">', self.body.decode('utf-8'))
+ def test_home_uplevel_check(self):
+ self._get('/../../../../../../etc/shadow')
+ self.assertStatus(403)
+
def test_home_en_us(self):
self._get('/', headers=[('Accept-Language', 'en-US')])
self.assertStatus(200)
projects / ceph.git / commitdiff