path_traversal with venv

[netstuff]

Hello!

I'm using poetry and got an issue with TEMPLATE_FOLDER option with exception TemplateFolderDoesNotExist because it not pass path_traversal check.

After debug I found out that:

• base = Path(__file__).parent.parent inside path_traversal equals to PosixPath('/Users/netstuff/Sites/mailout/api/.venv/lib/python3.9/site-packages')
• passed to TEMPLATE_FOLDER path equals to PosixPath('/Users/netstuff/Sites/mailout/api/src/mailout/templates/mail')

What can I do with it?
Thank you.

[kucera-lukas]

Hi,

the path traversal check is indeed broken, for now you could just monkey patch that function to always return True, (fastapi_mail.config.path_traversal = lambda *args, **kwargs: True).

I think that doing base = Path(os.getcwd()) should fix the issue.

[netstuff]

@kucera-lukas thank u very much! I have already done it ;)

[Turall]

Hi @netstuff, can you share your config file without creds. ?
project template folder should be at the root of the project or in subfolders.

conf = ConnectionConfig(
       ...
    TEMPLATE_FOLDER="./templates"
)

or

conf = ConnectionConfig(
       ...
    TEMPLATE_FOLDER="templates"
)

or

conf = ConnectionConfig(
       ...
    TEMPLATE_FOLDER="./templates/html/"
)

[netstuff]

Hi @Turall !

Here is my config (private settings is hidden by MAIL_SETTINGS)

ConnectionConfig(
    TEMPLATE_FOLDER=PosixPath('/Users/netstuff/project/api/src/templates/mail'),
    SUPPRESS_SEND=1,
    USE_CREDENTIALS=True,
    VALIDATE_CERTS=True,
    **MAIL_SETTINGS
)

[Turall]

Hi @Turall !

Here is my config (private settings is hidden by MAIL_SETTINGS)

ConnectionConfig(
    TEMPLATE_FOLDER=PosixPath('/Users/netstuff/project/api/src/templates/mail'),
    SUPPRESS_SEND=1,
    USE_CREDENTIALS=True,
    VALIDATE_CERTS=True,
    **MAIL_SETTINGS
)

if your project root folder is project you must set TEMPLATE_FOLDER="./api/src/templates/mail"

[Turall]

@netstuff could you solve your problem?

[sabuhish]

@Turall thanks for your help. He is right you should not set the full path, set it from the project root foler. @netstuff do you still face the same error?
Also one more suggestion to use:

TEMPLATE_FOLDER = Path(__file__).parent / 'template_folder',

[francois-travais]

I'm facing the same issue than @netstuff , and TEMPLATE_FOLDER = Path(__file__).parent / 'template_folder' doesn't work. I had to disable the path_traversal as @kucera-lukas suggested.