2021-10-26 21:41:14 +02:00
|
|
|
import os
|
|
|
|
|
|
2022-02-20 10:09:02 +02:00
|
|
|
|
2021-10-26 21:41:14 +02:00
|
|
|
class SuspiciousFileOperation(Exception):
|
|
|
|
|
pass
|
|
|
|
|
|
2022-02-20 10:09:02 +02:00
|
|
|
|
2021-10-26 21:41:14 +02:00
|
|
|
def path_traversal_check(unsafe_path, known_safe_path):
|
|
|
|
|
known_safe_path = os.path.abspath(known_safe_path)
|
|
|
|
|
unsafe_path = os.path.abspath(unsafe_path)
|
|
|
|
|
|
|
|
|
|
if (os.path.commonprefix([known_safe_path, unsafe_path]) != known_safe_path):
|
2023-07-09 12:29:11 +02:00
|
|
|
raise SuspiciousFileOperation(f"{unsafe_path} is not safe")
|
2021-10-26 21:41:14 +02:00
|
|
|
|
|
|
|
|
# Passes the check
|
|
|
|
|
return unsafe_path
|
