From a90f53f052dd5023ef0ab1538a3651bc1950a4ba Mon Sep 17 00:00:00 2001 From: Hykilpikonna Date: Thu, 25 Nov 2021 15:51:16 -0500 Subject: [PATCH] [F] Prevent path traversal attack --- src/report/report.py | 9 +++++++++ src/report/report_document.md | 4 +++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/src/report/report.py b/src/report/report.py index b9e60c6..271e6e0 100644 --- a/src/report/report.py +++ b/src/report/report.py @@ -79,6 +79,11 @@ def serve_report() -> None: :param path: Path of the resource :return: File resource or 404 """ + # Prevent path traversal attacks + if '..' in path: + return Response('Nope.') + + # Send file path = os.path.join(REPORT_DIR, path) return send_from_directory(Path(path).absolute().parent, Path(path).name) @@ -90,6 +95,10 @@ def serve_report() -> None: :param path: Path of the resource :return: File resource or 404 """ + # Prevent path traversal attacks + if '..' in path: + return Response('Nope.') + path = os.path.join(src_dir, 'resources', path) return send_from_directory(Path(path).absolute().parent, Path(path).name) diff --git a/src/report/report_document.md b/src/report/report_document.md index 7ca6f79..96b83e1 100644 --- a/src/report/report_document.md +++ b/src/report/report_document.md @@ -54,7 +54,7 @@ There are three divisions in this equation, so there are three possible places w @include `/pop/ignored.md` -Graphing the results, we find that the *TODO* +Graphing the results, we find that the ***TODO***
hist
@@ -69,6 +69,8 @@ Graphing the results, we find that the *TODO* After we answered how frequently people posted about COVID-19 and how interested are people to view these posts, we analyze our data over the posting dates to answer the second part of our research question: **How does posting frequency and people's interests in COVID-19 posts changes from the beginning of the pandemic to now?** +**_TODO_** + ## References