[PR] Prevent path traversal in static file routes (#912)

fasthtml/_modidx.py

@@ -130,6 +130,7 @@
                                'fasthtml.core._resp': ('api/core.html#_resp', 'fasthtml/core.py'),
                                'fasthtml.core._route_pn': ('api/core.html#_route_pn', 'fasthtml/core.py'),
                                'fasthtml.core._send_ws': ('api/core.html#_send_ws', 'fasthtml/core.py'),
+                               'fasthtml.core._static_fpath': ('api/core.html#_static_fpath', 'fasthtml/core.py'),
                                'fasthtml.core._to_htmx_header': ('api/core.html#_to_htmx_header', 'fasthtml/core.py'),
                                'fasthtml.core._to_xml': ('api/core.html#_to_xml', 'fasthtml/core.py'),
                                'fasthtml.core._url_for': ('api/core.html#_url_for', 'fasthtml/core.py'),

fasthtml/core.py

@@ -975,18 +975,27 @@ def reg_re_param(m, s):
 _static_exts = "ico gif jpg jpeg webm css js woff png svg mp4 webp ttf otf eot woff2 txt html map pdf zip tgz gz csv mp3 wav ogg flac aac doc docx xls xlsx ppt pptx epub mobi bmp tiff avi mov wmv mkv xml yaml yml rar 7z tar bz2 htm xhtml apk dmg exe msi swf iso".split()
 reg_re_param("static", '|'.join(_static_exts))
 
+def _static_fpath(static_path, relpath):
+    "Real path of `relpath` under `static_path`; 404 if it escapes `static_path` (e.g. `..` traversal)."
+    base = os.path.realpath(static_path)
+    fpath = os.path.realpath(os.path.join(base, relpath))
+    if fpath != base and not fpath.startswith(base + os.sep): raise HTTPException(404)
+    return fpath
+
 @patch
 def static_route_exts(self:FastHTML, prefix='/', static_path='.', exts='static'):
     "Add a static route at URL path `prefix` with files from `static_path` and `exts` defined by `reg_re_param()`"
     @self.get(f"{prefix}{{fname:path}}.{{ext:{exts}}}")
-    async def get(fname:str, ext:str): return FileResponse(f'{static_path}/{fname}.{ext}')
+    async def get(fname:str, ext:str): return FileResponse(_static_fpath(static_path, f'{fname}.{ext}'))
+
 
 # %% ../nbs/api/00_core.ipynb #b31de65a
 @patch
 def static_route(self:FastHTML, ext='', prefix='/', static_path='.'):
     "Add a static route at URL path `prefix` with files from `static_path` and single `ext` (including the '.')"
     @self.get(f"{prefix}{{fname:path}}{ext}")
-    async def get(fname:str): return FileResponse(f'{static_path}/{fname}{ext}')
+    async def get(fname:str): return FileResponse(_static_fpath(static_path, f'{fname}{ext}'))
+
 
 # %% ../nbs/api/00_core.ipynb #f63b7a03
 class StaticNoCache(StaticFiles):

nbs/api/00_core.ipynb

@@ -4349,11 +4349,18 @@
     "_static_exts = \"ico gif jpg jpeg webm css js woff png svg mp4 webp ttf otf eot woff2 txt html map pdf zip tgz gz csv mp3 wav ogg flac aac doc docx xls xlsx ppt pptx epub mobi bmp tiff avi mov wmv mkv xml yaml yml rar 7z tar bz2 htm xhtml apk dmg exe msi swf iso\".split()\n",
     "reg_re_param(\"static\", '|'.join(_static_exts))\n",
     "\n",
+    "def _static_fpath(static_path, relpath):\n",
+    "    \"Real path of `relpath` under `static_path`; 404 if it escapes `static_path` (e.g. `..` traversal).\"\n",
+    "    base = os.path.realpath(static_path)\n",
+    "    fpath = os.path.realpath(os.path.join(base, relpath))\n",
+    "    if fpath != base and not fpath.startswith(base + os.sep): raise HTTPException(404)\n",
+    "    return fpath\n",
+    "\n",
     "@patch\n",
     "def static_route_exts(self:FastHTML, prefix='/', static_path='.', exts='static'):\n",
     "    \"Add a static route at URL path `prefix` with files from `static_path` and `exts` defined by `reg_re_param()`\"\n",
     "    @self.get(f\"{prefix}{{fname:path}}.{{ext:{exts}}}\")\n",
-    "    async def get(fname:str, ext:str): return FileResponse(f'{static_path}/{fname}.{ext}')"
+    "    async def get(fname:str, ext:str): return FileResponse(_static_fpath(static_path, f'{fname}.{ext}'))\n"
    ]
   },
   {
@@ -4394,7 +4401,7 @@
     "def static_route(self:FastHTML, ext='', prefix='/', static_path='.'):\n",
     "    \"Add a static route at URL path `prefix` with files from `static_path` and single `ext` (including the '.')\"\n",
     "    @self.get(f\"{prefix}{{fname:path}}{ext}\")\n",
-    "    async def get(fname:str): return FileResponse(f'{static_path}/{fname}{ext}')"
+    "    async def get(fname:str): return FileResponse(_static_fpath(static_path, f'{fname}{ext}'))\n"
    ]
   },
   {
@@ -4408,6 +4415,27 @@
     "assert 'THIS FILE WAS AUTOGENERATED' in cli.get('/README.md').text"
    ]
   },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "id": "6a56e464",
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "# `..` in the URL path must not escape `static_path`, even to a file that exists (CVE-style path traversal)\n",
+    "import tempfile\n",
+    "with tempfile.TemporaryDirectory() as _root:\n",
+    "    _pub = Path(_root)/'public'; _pub.mkdir()\n",
+    "    (_pub/'ok.md').write_text('public')\n",
+    "    (Path(_root)/'secret.md').write_text('SECRET')  # sibling of static_path, outside it\n",
+    "    _ta = FastHTML()\n",
+    "    _ta.static_route('.md', static_path=str(_pub))\n",
+    "    _tc = Client(_ta)\n",
+    "    test_eq(_tc.get('/ok.md').text, 'public')                  # legit file still served\n",
+    "    test_eq(_tc.get('/%2e%2e/secret.md').status_code, 404)     # encoded `..` to a real file: blocked\n",
+    "    test_eq(_tc.get('/%2e%2e/%2e%2e/etc/passwd.md').status_code, 404)\n"
+   ]
+  },
   {
    "cell_type": "code",
    "execution_count": null,