Michel2/Tasmota
1
0
Fork 0
mirror of https://github.com/arendst/Tasmota.git synced 2026-07-27 20:05:46 +00:00
Code Issues Releases Activity

fix: avoid path traversal (#24694)

Browse Source
This commit is contained in:
orbisai0security
2026-05-03 17:27:47 +02:00
committed by GitHub
parent e8a7a209b5
commit 2c2445ce54
1 changed files with 4 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/ota_server/fw-server.py
+4 -5
View File
@@ -49,7 +49,7 @@ import os.path
from optparse import OptionParser from optparse import OptionParser
from sys import exit from sys import exit
from flask import Flask, send_file from flask import Flask, send_from_directory
import netifaces as ni import netifaces as ni
usage = "usage: fw-server {-d | -i} arg" usage = "usage: fw-server {-d | -i} arg"
@@ -90,10 +90,9 @@ app = Flask(__name__)
@app.route('/<filename>') @app.route('/<filename>')
def fw(filename): def fw(filename):
if os.path.exists(fwdir + str(filename)): if os.path.exists(os.path.join(fwdir, os.path.basename(filename))):
return send_file(fwdir + str(filename), return send_from_directory(fwdir, os.path.basename(filename),
attachment_filename=filename, mimetype='application/octet-stream')
mimetype='application/octet-stream')
return "ERROR: file not found" return "ERROR: file not found"