Skip to content

Instantly share code, notes, and snippets.

@stevage

stevage/gist:2210943

Created March 27, 2012 00:20
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save stevage/2210943 to your computer and use it in GitHub Desktop.
Save stevage/2210943 to your computer and use it in GitHub Desktop.
Download ZIP
Checking for unsafe filename paths
Raw
gistfile1.txt
Version 1:
def is_evil(filename):
import re
return re.search("^/|\.\./|:|//", filename)
if is_evil(filename):
filename = path.basename(filename)
copyto = path.join(dataset_path, filename)
Version 2:
copyto = path.join(dataset_path, filename)
if not copyto.startswith(dataset_path):
copyto = path.join(dataset_path, path.basename(filename))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment