Programming Forums - PyCherry Help? Is this safe?

Page 1 of 2

Show 40 post(s) from this thread on one page

Programming Forums (http://www.programmingforums.org/forumindex.php)

- Python (http://www.programmingforums.org/forum43.html)

- - PyCherry Help? Is this safe? (http://www.programmingforums.org/showthread.php?t=8085)

Sane	Jan 24th, 2006 12:25 AM

PyCherry Help? Is this safe?

I have a page that will take the GET parmater "filename" append it to the current working directory, then the downloads folder. And send a download attatchment for that file.

http://jammersbase.ath.cx/download?f...e=oxygene4.mid

Is there any way somebody could manipulate this by possibly lowering a directory then downloading main.py or something to gain access to my source?

I think I may have made it safe by making oxygene4 in a folder up from the main folder, because if they used a / to go up a folder, it will think you're looking for the folder oxygene4.

Meh, I think I'm just babbling. Exploits anyone?

Arevos

Jan 24th, 2006 2:37 AM

http://jammersbase.ath.cx/download?filename=../main.py

Cerulean

Jan 24th, 2006 8:36 AM

Heh. Just make sure the GET string you receive has no wacko characters in it - I tend to just only allow alphanumerics, underscores, dashes, and single dots

s = "../.../bar"

while s.count(".."):

    s = s.replace("..", ".")

# s == "././bar", aka "bar"

Arevos

Jan 24th, 2006 8:42 AM

Or use "os.path.basename". That should make things safe enough.

Jessehk

Jan 24th, 2006 8:57 AM

Quote:

Originally Posted by Arevos

http://jammersbase.ath.cx/download?filename=../main.py

That was hilarious. :D

coldDeath

Jan 24th, 2006 10:31 AM

Lol, you haven't looked at the sensitive content in the file yet :-)

Sane	Jan 24th, 2006 1:16 PM

omg GAH... >_<;;;;

People could use that to find the secret salt password, or open up people's user data files. @_@

*quickly rushes to solve problem*

Arevos

Jan 24th, 2006 2:32 PM

The occassional security issue aside, your site's looking pretty good, Sane. I was rather impressed with how far it's come along since you first started work on it. :)

Sane	Jan 24th, 2006 3:29 PM

Meh. Designing it was easy.

It's still the exact same site, just with the layout changed.

The only reason it looked like crap before was because it was just temporary. >_>

coldDeath

Jan 24th, 2006 3:55 PM

I liked the bit in the source saying:

adminpass = "passwordhere" lol :-)

All times are GMT -5. The time now is 1:10 PM.

Page 1 of 2

Show 40 post(s) from this thread on one page