Skip to content

Commit

Permalink
Fixed assert_safe_path for urls
Browse files Browse the repository at this point in the history
  • Loading branch information
roll committed Apr 25, 2024
1 parent f79031f commit 00ff24b
Showing 1 changed file with 7 additions and 6 deletions.
13 changes: 7 additions & 6 deletions dplib/helpers/path.py
Original file line number Diff line number Diff line change
Expand Up @@ -52,9 +52,10 @@ def is_url_path(path: str) -> bool:

def assert_safe_path(path: str, *, basepath: Optional[str] = None):
"""Assert that the path (untrusted) is not outside the basepath (trusted)"""
try:
root = Path(basepath or os.getcwd()).resolve()
item = root.joinpath(path).resolve()
item.relative_to(root)
except Exception:
raise Error(f"Path is not safe: {path}")
if not is_url_path(path):
try:
root = Path(basepath or os.getcwd()).resolve()
item = root.joinpath(path).resolve()
item.relative_to(root)
except Exception:
raise Error(f"Path is not safe: {path}")

0 comments on commit 00ff24b

Please sign in to comment.