tobias/radicale
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #619 from Unrud/log_unsafe_paths

Browse Source 
Log unsafe paths
This commit is contained in:
Unrud 2017-06-01 12:55:45 +02:00 committed by GitHub
commit ac230efa57
4 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
radicale/storage.py
View File

@ -484,7 +484,8 @@ class Collection(BaseCollection):
filesystem_path = path_to_filesystem(folder, sane_path) filesystem_path = path_to_filesystem(folder, sane_path)
except ValueError as e: except ValueError as e:
# Path is unsafe # Path is unsafe
cls.logger.info(e) cls.logger.debug("Collection with unsafe path %r requested: %s",
sane_path, e, exc_info=True)
return return
# Check if the path exists and if it leads to a collection or an item # Check if the path exists and if it leads to a collection or an item

1
radicale/tests/test_auth.py
View File

@ -26,7 +26,6 @@ import shutil
import tempfile import tempfile
import pytest import pytest
from radicale import Application, config from radicale import Application, config
from .test_base import BaseTest from .test_base import BaseTest

1
radicale/tests/test_base.py
View File

@ -26,7 +26,6 @@ import shutil
import tempfile import tempfile
import pytest import pytest
from radicale import Application, config from radicale import Application, config
from . import BaseTest from . import BaseTest

4
radicale/web.py
View File

@ -84,7 +84,9 @@ class Web(BaseWeb):
try: try:
filesystem_path = storage.path_to_filesystem( filesystem_path = storage.path_to_filesystem(
self.folder, path[len("/.web"):]) self.folder, path[len("/.web"):])
except ValueError: except ValueError as e:
self.logger.debug("Web content with unsafe path %r requested: %s",
path, e, exc_info=True)
return NOT_FOUND return NOT_FOUND
if os.path.isdir(filesystem_path) and not path.endswith("/"): if os.path.isdir(filesystem_path) and not path.endswith("/"):
location = posixpath.basename(path) + "/" location = posixpath.basename(path) + "/"