CTYPTO/freqtrade
1
0
Fork 0
mirror of https://github.com/freqtrade/freqtrade.git synced 2026-03-01 15:52:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: path traversal in web_ui

Browse Source
This commit is contained in:
Matthias
2026-02-24 21:52:37 +01:00
parent 34df7b1793
commit 48015a9b1b
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
freqtrade/rpc/api_server/web_ui.py
View File

@@ -37,8 +37,8 @@ async def index_html(rest_of_path: str):
"""
if rest_of_path.startswith("api") or rest_of_path.startswith("."):
raise HTTPException(status_code=404, detail="Not Found")
uibase = Path(__file__).parent / "ui/installed/"
filename = uibase / rest_of_path
uibase = (Path(__file__).parent / "ui/installed/").resolve()
filename = (uibase / rest_of_path).resolve()
# It's security relevant to check "relative_to".
# Without this, Directory-traversal is possible.
media_type: str | None = None