Fix/prevent static path traversal #87
Draft
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Latest pywb changes
APP-93 Added nobanner support.
APP-92 Fixed the access_checker.py, warcserver.py
Feature/query
Recorder Pending count (webrecorder#637)
Feature/date range
Added continuityutils.py Modified the html_rewriter.py for continuity. Modified rewriterapp.py to work with continuity. Added rejex and continuity feature in wburl.py
Made access check lookups more efficient
substituion functionality already exists on a global level for matched rules but this causes issues when rule sets conflict in the desired outcome. This change enables setting regex substitution at the rule level to avoid these conflicts.
Update from main
feat: regex substitution on surt rules match
fix: regex replace fixes
update from main, add rules fixes and /timeline/ url support
update from main
…tus codes and there are no results for that filter, PYWB will attempt to ditch your filter and just return the first 100 results it has for that URL. So, by default PYWB will try to get all 2xx and 3xx results. If none exist, it will then give you 100 4xx and 5xx results it has for that URL. I've changed the logic to not do the extra return if filters are supplied to the query. I need this to be tested extensively and confirmed non-destructive before we merge.
If You run a filter against the live service to only show certain sta…
Merge from upstream pywb
I've added the base functionality in PyWB to control the different permutations of toggles:
# a single digit end_timestamp controls the timeline filters
# <empty> - show one capture per day, and hide redirects
# 1 - show one capture per day, and show redirects
# 2 - show all captures, and hide redirects
# 3 - show all captures, and show redirects
These utilise the current `end_timestamp` regex parameter of `WbUrl`'s `QUERY_REGEX`:
QUERY_REGEX = re.compile('^(?:([\w\-:]+)/)?(\d*)(timeline|[*-])(\d*)/?(.+)$')
This means that URLs with the various filters applied will have a single digit numeric suffix to "timeline", such as:
http://0.0.0.0:8080/ukgwa/timeline/www.gov.uk
http://0.0.0.0:8080/ukgwa/timeline1/www.gov.uk
http://0.0.0.0:8080/ukgwa/timeline2/www.gov.uk
http://0.0.0.0:8080/ukgwa/timeline3/www.gov.uk
Added timeline filters
Update from main PYWB repo
chore: updates dependencies
Move Py3AMF from setup.py load_requirements to requirements.txt --------- Co-authored-by: Tessa Walsh <tessa@bitarchivist.net>
fix: wsgiprox 1.5.2 version bump
Prevents the path traversal attack reported in webrecorder#931
Prevent path traversal
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.