Skip to content

Commit

Permalink
Merge pull request from GHSA-8p25-3q46-8q2p
Browse files Browse the repository at this point in the history
  • Loading branch information
jesserockz committed Feb 25, 2024
1 parent 84c6e52 commit d814ed1
Showing 1 changed file with 19 additions and 5 deletions.
24 changes: 19 additions & 5 deletions esphome/dashboard/web_server.py
Original file line number Diff line number Diff line change
Expand Up @@ -806,8 +806,16 @@ class EditRequestHandler(BaseHandler):
@bind_config
async def get(self, configuration: str | None = None) -> None:
"""Get the content of a file."""
loop = asyncio.get_running_loop()
if not configuration.endswith((".yaml", ".yml")):
self.send_error(404)
return

filename = settings.rel_path(configuration)
if Path(filename).resolve().parent != settings.absolute_config_dir:
self.send_error(404)
return

loop = asyncio.get_running_loop()
content = await loop.run_in_executor(
None, self._read_file, filename, configuration
)
Expand All @@ -833,11 +841,17 @@ def _write_file(self, filename: str, content: bytes) -> None:
@bind_config
async def post(self, configuration: str | None = None) -> None:
"""Write the content of a file."""
if not configuration.endswith((".yaml", ".yml")):
self.send_error(404)
return

filename = settings.rel_path(configuration)
if Path(filename).resolve().parent != settings.absolute_config_dir:
self.send_error(404)
return

loop = asyncio.get_running_loop()
config_file = settings.rel_path(configuration)
await loop.run_in_executor(
None, self._write_file, config_file, self.request.body
)
await loop.run_in_executor(None, self._write_file, filename, self.request.body)
# Ensure the StorageJSON is updated as well
DASHBOARD.entries.async_schedule_storage_json_update(filename)
self.set_status(200)
Expand Down

0 comments on commit d814ed1

Please sign in to comment.