Commit9433f4b

authored

Merge commit from fork

1 parentd5c91ec commit9433f4bCopy full SHA for 9433f4b

File tree

+29

-1

lines changed

+29

-1

lines changed

Lines changed: 3 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -375,7 +375,9 @@ def __init__(self, file_name: bytes \| None, field_name: bytes \| None = None, con`
`375`	`375`
`376`	`376`	`# Split the extension from the filename.`
`377`	`377`	`iffile_nameisnotNone:`
`378`		`-base,ext=os.path.splitext(file_name)`
	`378`	`+# Extract just the basename to avoid directory traversal`
	`379`	`+basename=os.path.basename(file_name)`
	`380`	`+base,ext=os.path.splitext(basename)`
`379`	`381`	`self._file_base=base`
`380`	`382`	`self._ext=ext`
`381`	`383`

Lines changed: 26 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,26 @@`
	`1`	`+frompathlibimportPath`
	`2`	`+`
	`3`	`+frompython_multipart.multipartimportFile`
	`4`	`+`
	`5`	`+`
	`6`	`+deftest_upload_dir_with_leading_slash_in_filename(tmp_path:Path):`
	`7`	`+upload_dir=tmp_path/"upload"`
	`8`	`+upload_dir.mkdir()`
	`9`	`+`
	`10`	`+# When the file_name provided has a leading slash, we should only use the basename.`
	`11`	`+# This is to avoid directory traversal.`
	`12`	`+to_upload=tmp_path/"foo.txt"`
	`13`	`+`
	`14`	`+file=File(`
	`15`	`+bytes(to_upload),`
	`16`	`+config={`
	`17`	`+"UPLOAD_DIR":bytes(upload_dir),`
	`18`	`+"UPLOAD_KEEP_FILENAME":True,`
	`19`	`+"UPLOAD_KEEP_EXTENSIONS":True,`
	`20`	`+"MAX_MEMORY_FILE_SIZE":10,`
	`21`	`+ },`
	`22`	`+ )`
	`23`	`+file.write(b"123456789012")`
	`24`	`+assertnotfile.in_memory`
	`25`	`+assertPath(upload_dir/"foo.txt").exists()`
	`26`	`+assertPath(upload_dir/"foo.txt").read_bytes()==b"123456789012"`

Comments

(0)