Don't ignore local packages when watching #96
Conversation
| @@ -117,23 +117,25 @@ def index( | |||
| ) | |||
|
|
|||
| path = frontend_dir / "static" / file_name | |||
| if path.exists() and under_frontend_dir(frontend_dir, path): | |||
| if path.exists(): | |||
There was a problem hiding this comment.
Are you sure it is a good idea to remove the security check under_frontend_dir(frontend_dir, path)?
The reason for this check is not to allow requesting files that are not under the frontend_dir directory.
There was a problem hiding this comment.
It will always be true as path = frontend_dir / "static" / file_name (see line above L119)
There was a problem hiding this comment.
and if the file_name is something like ../../../../../../random_file?
There was a problem hiding this comment.
I tested (in the browser and with a CLI tool). The targeted url is resolved so you will never have dotted path in the filename (see also rfc3986 - the dot segments will be remove before forming the valid URL.
Anyway we should also switch to the StaticFiles handler.
There was a problem hiding this comment.
Great! Thank you soo much @fcollonval!
No description provided.