File tree Expand file tree Collapse file tree 1 file changed +11
-0
lines changed
jupyter_server/services/contents Expand file tree Collapse file tree 1 file changed +11
-0
lines changed Original file line number Diff line number Diff line change @@ -270,6 +270,17 @@ def _get_os_path(self, path):
270
270
if os .path .splitdrive (path )[0 ]:
271
271
raise HTTPError (404 , "%s is not a relative API path" % path )
272
272
os_path = to_os_path (ApiPath (path ), root )
273
+ # validate os path
274
+ # e.g. "foo\0" raises ValueError: embedded null byte
275
+ try :
276
+ os .lstat (os_path )
277
+ except OSError :
278
+ # OSError could be FileNotFound, PermissionError, etc.
279
+ # those should raise (or not) elsewhere
280
+ pass
281
+ except ValueError :
282
+ raise HTTPError (404 , f"{ path } is not a valid path" ) from None
283
+
273
284
if not (os .path .abspath (os_path ) + os .path .sep ).startswith (root ):
274
285
raise HTTPError (404 , "%s is outside root contents directory" % path )
275
286
return os_path
You can’t perform that action at this time.
0 commit comments