Do not allow access to resources outside of static.

[jgosmann]

This is another security issue. By providing paths like /static/../__init__.py it was possible to access arbitrary files on the file system. In master this requires at least authentication, but in #921 I'm removing the constraint because the favicon should be available without login and we might want to use some of the style sheets on the login page at some point.

[astoeckel]

I'm usually a little more radical in my webserver implementations. All browsers automatically collapse relative paths before the request is made.

So in addition to any logic you wrote, if any of the request path components is a "." or ".." you can be sure that this is a malicious hand-crafted request.

[tcstewar]

On Windows, this fails because the string passed to pkgutil.get_data is of the form \static\..... Windows then decides to treat this as c:\static\.... which it can't find.

Adding this line seems to fix it in windows: fn = os.path.relpath(fn, '/'). Alternatively, fn = fn[1:] could also work. I'm not sure if either of these are the correct solution, though....

[jgosmann]

I have to think about this.
In the meantime, I'd like to complain that drive letters are stupid idea (imo). ;)

[tcstewar]

In the meantime, I'd like to complain that drive letters are stupid idea (imo). ;)

Agreed. :)

[jgosmann]

I made a commit that should make this work on Windows too, but I haven't tested it on either OS.

[jgosmann]

Tested the change on Linux and works. Because browsers collapse .. in the URL, one has to use a tool like netcat. For example:

$ netcat localhost 8080
GET /static/../main.py?token=[TOKEN] HTTP/1.1
Host: localhost

(you need two newline at the end)

With this PR it will give a 403 response

HTTP/1.0 403 Forbidden
Server: BaseHTTP/0.6 Python/3.6.1
Date: Tue, 12 Dec 2017 20:54:41 GMT
Content-type: text/html
Set-Cookie: _session_id=1e2134ff11a84d8775629e6f2e108c91cfc349ca

whereas master will provide main.py:

HTTP/1.0 200 OK
Server: BaseHTTP/0.6 Python/3.6.1
Date: Tue, 12 Dec 2017 20:54:01 GMT
Content-Type: text/x-python
Content-Length: 4129
Set-Cookie: _session_id=489cd5aa032ae1a5b1c625659685cc0d24970a63

import argparse
import errno
import logging
import os.path
import threading
import webbrowser
...

[tcstewar]

Because browsers collapse .. in the URL, one has to use a tool like netcat

Nice! That's incredibly useful -- thank you... It works on Windows, btw... :)

[tcstewar]

This should have been merged ages ago.... thank you, @jgosmann , it's merged now!