fix symlink and .. attack

app.py

@@ -774,6 +774,8 @@ def repository_raw(username, repository, branch, subpath):

                                
                                
                                
                            
                                
                                    
                                        
                                            774  
                                                server_repo_location = os.path.join(config.REPOS_PATH, username, repository)
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            775  
                                                if not os.path.exists(server_repo_location):
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            776  
                                                    flask.abort(404)
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        777 +
                                            if os.path.commonpath([os.path.realpath(os.path.join(server_repo_location, subpath)), os.path.realpath(server_repo_location)]) != os.path.realpath(server_repo_location):
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        778 +
                                                flask.abort(404)
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            779  
                                                if not (get_visibility(username, repository) or get_permission_level(
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            780  
                                                        flask.session.get("username"), username,
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            781  
                                                        repository) is not None):
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        

@@ -863,6 +865,9 @@ def repository_tree(username, repository, branch, subpath):

                                
                                
                                
                            
                                
                                    
                                        
                                            865  
                                                for ref in repo.tags:
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            866  
                                                    all_refs.append((ref, "tag"))
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            867  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        868 +
                                            if os.path.commonpath([os.path.realpath(os.path.join(server_repo_location, subpath)), os.path.realpath(server_repo_location)]) != os.path.realpath(server_repo_location):
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        869 +
                                                flask.abort(404)
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        870 +
                                        
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            871  
                                                if os.path.isdir(os.path.join(server_repo_location, subpath)):
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            872  
                                                    files = []
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            873  
                                                    blobs = []
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        

@@ -934,6 +939,9 @@ def repository_tree(username, repository, branch, subpath):

                                
                                
                                
                            
                                
                                    
                                        
                                            939  
                                                    if not os.path.exists(path):
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            940  
                                                        return flask.render_template("errors/not-found.html"), 404
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            941  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        942 +
                                                if os.path.commonpath([os.path.realpath(path), os.path.realpath(server_repo_location)]) != os.path.realpath(server_repo_location):
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        943 +
                                                    flask.abort(404)
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        944 +
                                        
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            945  
                                                    mimetype = guess_mime(path)
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            946  
                                                    mode = mimetype.split("/", 1)[0]
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            947  
                                                    size = human_size(os.path.getsize(path))
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                            
                                

templates/tree-view.html

@@ -21,16 +21,12 @@

                                
                                
                                
                            
                                
                                    
                                        
                                            21  
                                                            <td>{{ file.mimetype }}</td>
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            22  
                                                            <td style="text-align: right;">{{ file.size }}</td>
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            23  
                                                            <td>
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        24 -
                                                            {% if file.commit %}
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        25 -
                                                                <a href="/{{ username }}/{{ repository }}/commit/{{ file.commit.sha }}" class="file-link">
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        26 -
                                                                    <x-hbox style="align-items: baseline; gap: 0.5ch;">
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        27 -
                                                                        <code>{{ file.commit.sha[:file.shaSize] }}</code>
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        28 -
                                                                        <span class="commit-message">{{ file.commit.message }}</span>
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        29 -
                                                                    </x-hbox>
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        30 -
                                                                </a>
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        31 -
                                                            {% else %}
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        32 -
                                                                ???
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        33 -
                                                            {% endif %}
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        24 +
                                                            <a href="/{{ username }}/{{ repository }}/commit/{{ file.commit.sha }}" class="file-link">
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        25 +
                                                                <x-hbox style="align-items: baseline; gap: 0.5ch;">
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        26 +
                                                                    <code>{{ file.commit.sha[:file.shaSize] }}</code>
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        27 +
                                                                    <span class="commit-message">{{ file.commit.message }}</span>
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        28 +
                                                                </x-hbox>
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        29 +
                                                            </a>
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            30  
                                                            </td>
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            31  
                                                        </tr>
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            32  
                                                    {% endfor %}