Datasette on Amazon Linux on ARM returns 404 for static assets #1124
Comments
|
The CSS files are in the expected location: Wow it's running an ANCIENT version of SQLite: http://www.sqlite.org/releaselog/3_7_17.html - SQLite Release 3.7.17 On 2013-05-20 |
|
Added a line to print out Lines 848 to 853 in e048791 |
|
I'm suspicious of this code here: datasette/datasette/utils/asgi.py Lines 284 to 307 in e048791 |
|
I replaced that function with this code: def asgi_static(root_path, chunk_size=4096, headers=None, content_type=None):
async def inner_static(request, send):
path = request.scope["url_route"]["kwargs"]["path"]
print("path =", path)
try:
full_path = (Path(root_path) / path).resolve().absolute()
except FileNotFoundError as e:
print("FileNotFoundError:", e)
await asgi_send_html(send, "404", 404)
return
if full_path.is_dir():
await asgi_send_html(send, "403: Directory listing is not allowed", 403)
return
# Ensure full_path is within root_path to avoid weird "../" tricks
try:
print("full_path={}, root_path={}".format(full_path, root_path))
full_path.relative_to(root_path)
except ValueError as e:
print(" ValueError:", e)
await asgi_send_html(send, "404", 404)
return
try:
await asgi_send_file(send, full_path, chunk_size=chunk_size)
except FileNotFoundError:
await asgi_send_html(send, "404", 404)
return
return inner_staticEdited using The output shows me what the bug is:
One is |
|
This fix works - calling # Ensure full_path is within root_path to avoid weird "../" tricks
try:
print("full_path={}, root_path={}".format(full_path, root_path))
full_path.relative_to(root_path.resolve())
except ValueError as e:
print(" ValueError:", e)
await asgi_send_html(send, "404", 404)
return |
|
I'm going to punt on writing a unit test for this (not sure how I'd simulate those symlinks) - I'll manually test it and push out a dot release instead. |
|
I tested this by running: To replace that version of Datasette (in the correct virtual environment) with this patch. It worked! |
|
https://github.com/simonw/datasette/runs/1494631261 |
|
Confirmed that installing a fresh copy of Datasette 0.52.3 on that server works correctly as expected. |
Very weird bug this one. Steps to reproduce:
The text was updated successfully, but these errors were encountered: