Commit e5e6bda4 authored by Dannon Baker's avatar Dannon Baker
Browse files

Contain directory traversal for static files to host static root.

parent 7136d72b

lib/galaxy/web/framework/middleware/static.py

+5 −1
Original line number Diff line number Diff line
@@ -38,7 +38,11 @@ class CacheableStaticURLParser(StaticURLParser): 
                    directory = host_val

                    break



        full = os.path.join(directory, filename)

        full = self.normpath(os.path.join(directory, filename))

        if not full.startswith(directory):

            # Out of bounds

            return self.not_found(environ, start_response)



        if not os.path.exists(full):

            return self.not_found(environ, start_response)

        if os.path.isdir(full):