Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sanic static directory fails when folder name ends with ".." #2477

ekzhang opened this issue Jun 10, 2022 · 2 comments

Sanic static directory fails when folder name ends with ".." #2477

ekzhang opened this issue Jun 10, 2022 · 2 comments


Copy link

ekzhang commented Jun 10, 2022

Describe the bug

When serving a static file named a../b.txt with app.static(), the Sanic request handler gives a 400 status code instead of 200.

Code snippet

First file is called

from sanic import Sanic

app = Sanic(name="sanic_test")

app.static('/static', './static_files')

if __name__ == "__main__":"", port=8000)

Then, make the file in question:

mkdir -p static_files/a../
cat "hello world" > static_files/a../b.txt

And run the server with python, followed by a GET request.

$ curl http://localhost:8000/static/a../b.txt
⚠️ 400 — Bad Request
Invalid URL

Expected behavior

The app.static() handler should serve the b.txt file with a 200 response code.

Environment (please complete the following information):

  • OS: macOS and Linux
  • Version 22.3.0
Copy link

stale bot commented Sep 21, 2022

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. If this is incorrect, please respond with an update. Thank you for your contributions.

@stale stale bot added the stale label Sep 21, 2022
Copy link

This has been solved in the previous PRs. Feel free to reopen if there is still an issue.

Tested and is no longer reproducible.


Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet

No branches or pull requests

2 participants