ar0c/xiaomusic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 处理安全问题

Browse Source
This commit is contained in:
涵曦 2024-08-01 00:46:18 +00:00
parent a8fefc6f82
commit cf01039b53
2 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
xiaomusic/gate.py
View File

@ -61,7 +61,9 @@ range_pattern = re.compile(r"bytes=(\d+)-(\d*)")
@app.get("/music/{file_path:path}") @app.get("/music/{file_path:path}")
async def music_file(request: Request, file_path: str): async def music_file(request: Request, file_path: str):
absolute_path = os.path.abspath(config.music_path) absolute_path = os.path.abspath(config.music_path)
absolute_file_path = os.path.join(absolute_path, file_path) absolute_file_path = os.path.normpath(os.path.join(absolute_path, file_path))
if not absolute_file_path.startswith(absolute_path):
raise HTTPException(status_code=404, detail="File not found")
if not os.path.exists(absolute_file_path): if not os.path.exists(absolute_file_path):
raise HTTPException(status_code=404, detail="File not found") raise HTTPException(status_code=404, detail="File not found")

4
xiaomusic/httpserver.py
View File

@ -315,7 +315,9 @@ range_pattern = re.compile(r"bytes=(\d+)-(\d*)")
@app.get("/music/{file_path:path}") @app.get("/music/{file_path:path}")
async def music_file(request: Request, file_path: str): async def music_file(request: Request, file_path: str):
absolute_path = os.path.abspath(config.music_path) absolute_path = os.path.abspath(config.music_path)
absolute_file_path = os.path.join(absolute_path, file_path) absolute_file_path = os.path.normpath(os.path.join(absolute_path, file_path))
if not absolute_file_path.startswith(absolute_path):
raise HTTPException(status_code=404, detail="File not found")
if not os.path.exists(absolute_file_path): if not os.path.exists(absolute_file_path):
raise HTTPException(status_code=404, detail="File not found") raise HTTPException(status_code=404, detail="File not found")