Skip to content

Fix/prevent static path traversal #86

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
32bitbradley merged 9 commits into from
Apr 16, 2025
Merged

Fix/prevent static path traversal #86

32bitbradley merged 9 commits into from
Apr 16, 2025

Conversation

@32bitbradley
Copy link

@32bitbradley 32bitbradley commented Apr 16, 2025

No description provided.

omgoo and others added 9 commits July 2, 2024 11:35
@omgoo
chore: update gevent
919385f
@omgoo
chore: fix to gevent version
cb96353
@omgoo
Merge pull request #83 from mirrorweb/update-gevent
52ac8e6 
chore: update gevent
@Hellseher @tw4l
requirements: Adjust installation of Py3AMF module. (webrecorder#920)
b44c93b 
Move Py3AMF from setup.py load_requirements to requirements.txt

---------

Co-authored-by: Tessa Walsh <tessa@bitarchivist.net>
@tw4l
Use JSON values in query string for JSON request bodies (webrecorder#893
7b0f8b5 
)

This commit also adds a more complicated JSON test case that is
also in warcio.js to ensure parity.

Treat numbers like JavaScript's Number.prototype.toString() by
dropping decimal from floats if they represent whole number.
@white-gecko
Allow to configure uWSGI mount via environment variable (webrecorder#926
0de883e 
)

* Introduce UWSGI_MOUNT env var

* Add a note to the documentation.
@ato
Refuse to serve static files that are outside of static_dir
8f2f0dc 
Prevents the path traversal attack reported in webrecorder#931
@32bitbradley
Merge pull request #85 from nla/prevent-path-traversal
ae17cb8 
Prevent path traversal
@32bitbradley
Merge branch 'tna' into fix/prevent-static-path-traversal
7d66b8e
@ChrisDoyleMW ChrisDoyleMW self-requested a review April 16, 2025 09:58
@32bitbradley 32bitbradley merged commit dede971 into tna Apr 16, 2025
0 of 10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ChrisDoyleMW ChrisDoyleMW ChrisDoyleMW approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

8 participants

@32bitbradley @ChrisDoyleMW @omgoo @Hellseher @tw4l @white-gecko @ato