mirrors/Radicale
1
0
Fork 0
mirror of https://github.com/Kozea/Radicale.git synced 2025-04-04 13:47:37 +03:00
Code Issues Projects Releases Packages Wiki Activity

Style

Browse source
This commit is contained in:
Guillaume Ayoub 2015-12-31 12:49:41 +01:00
parent 95fe2b6824
commit e7ce00d54f
6 changed files with 53 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

35
radicale/pathutils.py
View file

@ -16,7 +16,7 @@
# along with Radicale. If not, see <http://www.gnu.org/licenses/>.
"""
Helper functions for working with paths
Helper functions for working with paths.
"""
@ -27,8 +27,11 @@ from . import log
def sanitize_path(path):
"""Make absolute (with leading slash) to prevent access to other data.
Preserves an potential trailing slash."""
"""Make path absolute with leading slash to prevent access to other data.
Preserve a potential trailing slash.
"""
trailing_slash = "/" if path.endswith("/") else ""
path = posixpath.normpath(path)
new_path = "/"
@ -41,7 +44,11 @@ def sanitize_path(path):
def is_safe_path_component(path):
"""Checks if path is a single component of a path and is safe to join"""
"""Check if path is a single component of a POSIX path.
Check that the path is safe to join too.
"""
if not path:
return False
head, _ = posixpath.split(path)
@ -53,8 +60,11 @@ def is_safe_path_component(path):
def is_safe_filesystem_path_component(path):
"""Checks if path is a single component of a local filesystem path
and is safe to join"""
"""Check if path is a single component of a filesystem path.
Check that the path is safe to join too.
"""
if not path:
return False
drive, _ = os.path.splitdrive(path)
@ -69,16 +79,19 @@ def is_safe_filesystem_path_component(path):
def path_to_filesystem(path, base_folder):
"""Converts path to a local filesystem path relative to base_folder
in a secure manner or raises ValueError."""
"""Convert path to a local filesystem path relative to base_folder.
Conversion is done in a secure manner, or raises ValueError.
"""
sane_path = sanitize_path(path).strip("/")
safe_path = base_folder
if not sane_path:
return safe_path
for part in sane_path.split("/"):
if not is_safe_filesystem_path_component(part):
log.LOGGER.debug("Can't translate path safely to filesystem: %s",
path)
log.LOGGER.debug(
"Can't translate path safely to filesystem: %s", path)
raise ValueError("Unsafe path")
safe_path = os.path.join(safe_path, part)
return safe_path
return safe_path