Skip to content

Prevent path traversal #85

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
32bitbradley merged 4 commits into from
Apr 16, 2025
Merged

Prevent path traversal #85

32bitbradley merged 4 commits into from
Apr 16, 2025

Conversation

@32bitbradley
Copy link

@32bitbradley 32bitbradley commented Apr 16, 2025

No description provided.

Hellseher and others added 4 commits November 7, 2024 12:09
@Hellseher @tw4l
requirements: Adjust installation of Py3AMF module. (webrecorder#920)
b44c93b 
Move Py3AMF from setup.py load_requirements to requirements.txt

---------

Co-authored-by: Tessa Walsh <tessa@bitarchivist.net>
@tw4l
Use JSON values in query string for JSON request bodies (webrecorder#893
7b0f8b5 
)

This commit also adds a more complicated JSON test case that is
also in warcio.js to ensure parity.

Treat numbers like JavaScript's Number.prototype.toString() by
dropping decimal from floats if they represent whole number.
@white-gecko
Allow to configure uWSGI mount via environment variable (webrecorder#926
0de883e 
)

* Introduce UWSGI_MOUNT env var

* Add a note to the documentation.
@ato
Refuse to serve static files that are outside of static_dir
8f2f0dc 
Prevents the path traversal attack reported in webrecorder#931
@ChrisDoyleMW ChrisDoyleMW self-requested a review April 16, 2025 09:53
@32bitbradley 32bitbradley merged commit ae17cb8 into mirrorweb:fix/prevent-static-path-traversal Apr 16, 2025
0 of 5 checks passed
@ato ato deleted the prevent-path-traversal branch April 17, 2025 07:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ChrisDoyleMW ChrisDoyleMW ChrisDoyleMW approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@32bitbradley @ChrisDoyleMW @Hellseher @tw4l @white-gecko @ato