mohammadian7/freqtrade
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: path traversal in web_ui

Browse Source
This commit is contained in:
Matthias
2026-02-24 21:52:37 +01:00
parent 34df7b1793
commit 48015a9b1b
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
freqtrade/rpc/api_server/web_ui.py
+2 -2
View File
@@ -37,8 +37,8 @@ async def index_html(rest_of_path: str):
""" """
if rest_of_path.startswith("api") or rest_of_path.startswith("."): if rest_of_path.startswith("api") or rest_of_path.startswith("."):
raise HTTPException(status_code=404, detail="Not Found") raise HTTPException(status_code=404, detail="Not Found")
uibase = Path(__file__).parent / "ui/installed/" uibase = (Path(__file__).parent / "ui/installed/").resolve()
filename = uibase / rest_of_path filename = (uibase / rest_of_path).resolve()
# It's security relevant to check "relative_to". # It's security relevant to check "relative_to".
# Without this, Directory-traversal is possible. # Without this, Directory-traversal is possible.
media_type: str | None = None media_type: str | None = None