From 7bc746b8aefe740dbb4146f28cf5b27b793849ed Mon Sep 17 00:00:00 2001 From: Tat Dat Duong Date: Wed, 25 Oct 2023 16:52:29 +0200 Subject: [PATCH] Fix parent root escape exploit --- langserve/playground.py | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/langserve/playground.py b/langserve/playground.py index f897081f..e3321622 100644 --- a/langserve/playground.py +++ b/langserve/playground.py @@ -24,11 +24,21 @@ async def serve_playground( base_url: str, file_path: str, ) -> Response: - local_file_path = os.path.join( - os.path.dirname(__file__), - "./playground/dist", - file_path or "index.html", + local_file_path = os.path.abspath( + os.path.join( + os.path.dirname(__file__), + "./playground/dist", + file_path or "index.html", + ) ) + + base_dir = os.path.abspath( + os.path.join(os.path.dirname(__file__), "./playground/dist") + ) + + if base_dir != os.path.commonpath((base_dir, local_file_path)): + return Response("Not Found", status_code=404) + with open(local_file_path) as f: mime_type = mimetypes.guess_type(local_file_path)[0] if mime_type in ("text/html", "text/css", "application/javascript"):