From 6cf953aaabc52a57b579143867715300349a5a0f Mon Sep 17 00:00:00 2001 From: Alok Saldanha Date: Thu, 19 Sep 2019 12:54:26 -0400 Subject: [PATCH] #5 added os.path.join to flask routes Also added a subdir check for security. --- cellxgene_gateway/gateway.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/cellxgene_gateway/gateway.py b/cellxgene_gateway/gateway.py index fb591e5..f43983b 100644 --- a/cellxgene_gateway/gateway.py +++ b/cellxgene_gateway/gateway.py @@ -26,7 +26,7 @@ from werkzeug import secure_filename from cellxgene_gateway import env from cellxgene_gateway.backend_cache import BackendCache from cellxgene_gateway.cellxgene_exception import CellxgeneException -from cellxgene_gateway.dir_util import create_dir, recurse_dir, render_entries +from cellxgene_gateway.dir_util import create_dir, recurse_dir, render_entries, is_subdir from cellxgene_gateway.extra_scripts import get_extra_scripts from cellxgene_gateway.path_util import get_dataset, get_file_path from cellxgene_gateway.process_exception import ProcessException @@ -125,14 +125,14 @@ def make_subdir(): def upload_file(): upload_dir = request.form["path"] - full_upload_path = env.cellxgene_data + "/" + upload_dir - if os.path.isdir(full_upload_path): + full_upload_path = os.path.join(env.cellxgene_data, upload_dir) + if is_subdir(full_upload_path, env.cellxgene_data) and os.path.isdir(full_upload_path): if request.method == "POST": if "file" in request.files: f = request.files["file"] if f and f.filename.endswith(".h5ad"): f.save( - full_upload_path + "/" + secure_filename(f.filename) + os.path.join(full_upload_path, secure_filename(f.filename)) ) return redirect("/filecrawl.html", code=302) else: