Programming Forums > Script Programming > Python

Sane · Jan 24th, 2006, 12:25 AM

I have a page that will take the GET parmater "filename" append it to the current working directory, then the downloads folder. And send a download attatchment for that file.

http://jammersbase.ath.cx/download?f...e=oxygene4.mid

Is there any way somebody could manipulate this by possibly lowering a directory then downloading main.py or something to gain access to my source?

I think I may have made it safe by making oxygene4 in a folder up from the main folder, because if they used a / to go up a folder, it will think you're looking for the folder oxygene4.

Meh, I think I'm just babbling. Exploits anyone?

Arevos · Jan 24th, 2006, 2:37 AM

http://jammersbase.ath.cx/download?filename=../main.py

Cerulean · Jan 24th, 2006, 8:36 AM

Heh. Just make sure the GET string you receive has no wacko characters in it - I tend to just only allow alphanumerics, underscores, dashes, and single dots

(Toggle Plain Text)

s = "../.../bar"
while s.count(".."):
    s = s.replace("..", ".")
# s == "././bar", aka "bar"

Arevos · Jan 24th, 2006, 8:42 AM

Or use "os.path.basename". That should make things safe enough.

Jessehk · Jan 24th, 2006, 8:57 AM

Quote:

Originally Posted by Arevos

http://jammersbase.ath.cx/download?filename=../main.py

That was hilarious.

coldDeath · Jan 24th, 2006, 10:31 AM

Lol, you haven't looked at the sensitive content in the file yet :-)

Sane · Jan 24th, 2006, 1:16 PM

omg GAH... >_<;;;;

People could use that to find the secret salt password, or open up people's user data files. @_@

*quickly rushes to solve problem*

Arevos · Jan 24th, 2006, 2:32 PM

The occassional security issue aside, your site's looking pretty good, Sane. I was rather impressed with how far it's come along since you first started work on it.

Sane · Jan 24th, 2006, 3:29 PM

Meh. Designing it was easy.

It's still the exact same site, just with the layout changed.

The only reason it looked like crap before was because it was just temporary. >_>

coldDeath · Jan 24th, 2006, 3:55 PM

I liked the bit in the source saying:

adminpass = "passwordhere" lol :-)

Jan 24th, 2006, 12:25 AM	#1
Sane Programming Guru Join Date: Apr 2005 Posts: 1,799 Rep Power: 5	PyCherry Help? Is this safe? I have a page that will take the GET parmater "filename" append it to the current working directory, then the downloads folder. And send a download attatchment for that file. http://jammersbase.ath.cx/download?f...e=oxygene4.mid Is there any way somebody could manipulate this by possibly lowering a directory then downloading main.py or something to gain access to my source? I think I may have made it safe by making oxygene4 in a folder up from the main folder, because if they used a / to go up a folder, it will think you're looking for the folder oxygene4. Meh, I think I'm just babbling. Exploits anyone?

Jan 24th, 2006, 8:36 AM	#3
Cerulean Professional Programmer Join Date: Apr 2005 Location: London, England Posts: 459 Rep Power: 4	Heh. Just make sure the GET string you receive has no wacko characters in it - I tend to just only allow alphanumerics, underscores, dashes, and single dots (Toggle Plain Text) s = "../.../bar" while s.count(".."): s = s.replace("..", ".") # s == "././bar", aka "bar" s = "../.../bar" while s.count(".."): s = s.replace("..", ".") # s == "././bar", aka "bar"

Jan 24th, 2006, 10:31 AM	#6
coldDeath Expert Programmer Join Date: Aug 2005 Location: UK Posts: 862 Rep Power: 3	Lol, you haven't looked at the sensitive content in the file yet :-) __________________ Programming Tutorials - Linux Installation Guide - Learn Python - Learn C++ Got Slack? Join us at #programmingforums @ irc.freenode.net! My software never has bugs. It just develops random features.

Jan 24th, 2006, 3:55 PM	#10
coldDeath Expert Programmer Join Date: Aug 2005 Location: UK Posts: 862 Rep Power: 3	I liked the bit in the source saying: adminpass = "passwordhere" lol :-) __________________ Programming Tutorials - Linux Installation Guide - Learn Python - Learn C++ Got Slack? Join us at #programmingforums @ irc.freenode.net! My software never has bugs. It just develops random features.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Jan 24th, 2006, 2:37 AM	#2
Arevos Programming Guru Join Date: Aug 2005 Location: England Posts: 1,499 Rep Power: 4	http://jammersbase.ath.cx/download?filename=../main.py

Jan 24th, 2006, 8:42 AM	#4
Arevos Programming Guru Join Date: Aug 2005 Location: England Posts: 1,499 Rep Power: 4	Or use "os.path.basename". That should make things safe enough.

Jan 24th, 2006, 1:16 PM	#7
Sane Programming Guru Join Date: Apr 2005 Posts: 1,799 Rep Power: 5	omg GAH... >_<;;;; People could use that to find the secret salt password, or open up people's user data files. @_@ quickly rushes to solve problem

Jan 24th, 2006, 2:32 PM	#8
Arevos Programming Guru Join Date: Aug 2005 Location: England Posts: 1,499 Rep Power: 4	The occassional security issue aside, your site's looking pretty good, Sane. I was rather impressed with how far it's come along since you first started work on it.

Jan 24th, 2006, 3:29 PM	#9
Sane Programming Guru Join Date: Apr 2005 Posts: 1,799 Rep Power: 5	Meh. Designing it was easy. It's still the exact same site, just with the layout changed. The only reason it looked like crap before was because it was just temporary. >_>

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)

Programming Forums > Script Programming > Python

PyCherry Help? Is this safe?