Closed chuckds closed 1 year ago
Looks like Sanic should resolve that static dir path when the route is defined, making it an absolute path without any ..
elements. If that is the only thing missing, it should be easy to fix this. PRs welcome, if you are up to that :)
https://github.com/sanic-org/sanic/blob/main/sanic/mixins/static.py#L98
All we need is a .resolve()
on this line and a test.
Is there an existing issue for this?
Describe the bug
Sanic does serve static files if the server file path contains "..", instead it returns file not found errors.
Code snippet
The following doesn't work:
Attempt to access any files in the static directory will get the error:
[2023-03-27 04:05:31 -0700] [60813] [ERROR] File not found: path=static/../static, relative_url=test.txt
Removing the redundant../static/
will result in the files being correctly served.Expected Behavior
The above example should serve all files in the static directory and not return file not found errors.
How do you run Sanic?
Sanic CLI
Operating System
linux
Sanic Version
22.9.1
Additional context
This issue appears to have been introduced by #2506 or #2508. The fix might look something like the following:
It looks like the ".." was originally being done on the URI part only but with the #2506 change this is now done on the combination of the root path and relative path. The above change instead uses the resolved form of the root path (which won't contain "..").
However, there are likely other options and having more context about what the checks in this area are for would be crucial.