Skip to content

Commit bcaf452

Browse files
author
Unrud
committed
Convert component names safely to filenames
Component names are controlled by the user and without this checks access to arbitrary files is possible if the multifilesystem backend is used.
1 parent b4b3d51 commit bcaf452

File tree

1 file changed

+10
-0
lines changed

1 file changed

+10
-0
lines changed

Diff for: radicale/storage/multifilesystem.py

+10
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,11 @@ def write(self):
5353
name = (
5454
component.name if sys.version_info[0] >= 3 else
5555
component.name.encode(filesystem.FILESYSTEM_ENCODING))
56+
if not pathutils.is_safe_filesystem_path_component(name):
57+
log.LOGGER.debug(
58+
"Can't tranlate name safely to filesystem, "
59+
"skipping component: %s", name)
60+
continue
5661
filesystem_path = os.path.join(self._filesystem_path, name)
5762
with filesystem.open(filesystem_path, "w") as fd:
5863
fd.write(text)
@@ -62,6 +67,11 @@ def delete(self):
6267
os.remove(self._props_path)
6368

6469
def remove(self, name):
70+
if not pathutils.is_safe_filesystem_path_component(name):
71+
log.LOGGER.debug(
72+
"Can't tranlate name safely to filesystem, "
73+
"skipping component: %s", name)
74+
return
6575
filesystem_path = os.path.join(self._filesystem_path, name)
6676
if os.path.exists(filesystem_path):
6777
os.remove(filesystem_path)

0 commit comments

Comments
 (0)