Arbitrary path traversal possible with StaticFiles

[erinpentecost]

If you pass in an absolute path by using an URL formatted like this: http://localhost:5000/staticmount/c%3a%5cwindows%5cwin.ini

Then you can read any file on the host machine.

This is because of the following python behavior:

>>> dir = "c:\workspace\somepoject\somepackag\statics"
>>> path = "c:\windows\win.ini"
>>> os.path.join(dir, path)
'c:\\windows\\win.ini'

So staticfiles.py needs to be updated by placing in a check for absolute paths inside lookup_path(...).

[tomchristie]

Thanks. We're checking and handling path breakouts, but we've obviously not covered the windows-specific case of breaking out using a drive-absolute path. Will have a look into resolving this as a priority.