YunoHost/package_linter
1
0
Fork 0
mirror of https://github.com/YunoHost/package_linter.git synced 2024-09-03 20:06:12 +02:00
Code Issues Projects Releases Packages Wiki Activity

Fix path traversal issue detection, the alias folder also needs to end with / for path traversal to happen

Browse source
This commit is contained in:
Alexandre Aubin 2019-03-20 20:32:30 +01:00 committed by Alexandre Aubin
parent acc32c9796
commit 16bb33b884
1 changed files with 6 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
package_linter.py
View file

@ -196,7 +196,7 @@ class App():
for line in locationblock[1]: for line in locationblock[1]:
instruction = line[0] instruction = line[0]
if instruction == "alias": if instruction == "alias":
yield location yield (location, line)
elif isinstance(instruction, list) and instruction and instruction[0] == "location": elif isinstance(instruction, list) and instruction and instruction[0] == "location":
yield from find_location_with_alias(instruction) yield from find_location_with_alias(instruction)
else: else:
@ -205,8 +205,9 @@ class App():
def find_path_traversal_issue(nginxconf): def find_path_traversal_issue(nginxconf):
for block in nginxconf: for block in nginxconf:
for location in find_location_with_alias(block): for location, alias in find_location_with_alias(block):
if not location.endswith("/"): alias_path = alias[-1]
if not location.endswith("/") and alias_path.endswith("/"):
yield location yield location
for location in find_path_traversal_issue(nginxconf): for location in find_path_traversal_issue(nginxconf):