Flask: sanitize OGC schema pathing (#1593)

geopython · Mar 12, 2024 · ff4c4f6 · ff4c4f6
1 parent d8a1b74
commit ff4c4f6
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/pygeoapi/flask_app.py b/pygeoapi/flask_app.py
@@ -101,8 +101,11 @@ def schemas(path):
         dirname_ = os.path.dirname(full_filepath)
         basename_ = os.path.basename(full_filepath)
 
-        # TODO: better sanitization?
-        path_ = dirname_.replace('..', '').replace('//', '')
+        path_ = dirname_.replace('..', '').replace('//', '').replace('./', '')
+
+        if '..' in path_:
+            return 'Invalid path', 400
+
         return send_from_directory(path_, basename_,
                                    mimetype=get_mimetype(basename_))