ferdi2go/OnlyFrames
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security: Path Traversal in /preview und /detect-angle #1

New Issue
Closed
opened 2026-04-23 14:13:51 +02:00 by ferdi2go · 1 comment
ferdi2go commented 2026-04-23 14:13:51 +02:00
Owner
Copy Link
Copy Source

Problem\n\nDer path-Parameter in /preview (server.py:207) und /detect-angle (server.py:469) wird nicht gegen das Temp-Verzeichnis geprüft.\n\nJeder authentifizierte Nutzer kann beliebige Bilddateien vom Dateisystem lesen, z.B.:\n\nGET /preview?path=/home/vchuser/geheimnis.jpg\n\n\n## Fix\n\nPfad-Validierung analog zur vorhandenen Logik in /download:\npython\nif not os.path.abspath(path).startswith(tempfile.gettempdir()):\n raise HTTPException(status_code=403)\n

## Problem\n\nDer `path`-Parameter in `/preview` ([server.py:207](server.py#L207)) und `/detect-angle` ([server.py:469](server.py#L469)) wird nicht gegen das Temp-Verzeichnis geprüft.\n\nJeder authentifizierte Nutzer kann beliebige Bilddateien vom Dateisystem lesen, z.B.:\n```\nGET /preview?path=/home/vchuser/geheimnis.jpg\n```\n\n## Fix\n\nPfad-Validierung analog zur vorhandenen Logik in `/download`:\n```python\nif not os.path.abspath(path).startswith(tempfile.gettempdir()):\n raise HTTPException(status_code=403)\n```
ferdi2go added the priority: highsecurity labels 2026-04-23 14:13:51 +02:00
ferdi2go commented 2026-04-23 14:22:49 +02:00
Author
Owner
Copy Link
Copy Source

Fixed in commit be0a790.

Fixed in commit `be0a790`.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
maintenance
priority: high
priority: low
priority: medium
security
ux
No Label priority: high security
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
ferdi2go
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: ferdi2go/OnlyFrames#1
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?