Flask: sanitize OGC schema pathing (geopython#1593)

totycro · Mar 17, 2024 · 4fdb921 · 4fdb921
1 parent e3b5881
commit 4fdb921
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/pygeoapi/flask_app.py b/pygeoapi/flask_app.py
@@ -109,8 +109,11 @@ def schemas(path):
  dirname_ = os.path.dirname(full_filepath)
  basename_ = os.path.basename(full_filepath)
 
- # TODO: better sanitization?
- path_ = dirname_.replace('..', '').replace('//', '')
+ path_ = dirname_.replace('..', '').replace('//', '').replace('./', '')
+
+ if '..' in path_:
+ return 'Invalid path', 400
+
  return send_from_directory(path_, basename_,
  mimetype=get_mimetype(basename_))