Skip to content

Commit

Permalink
mypy type formatting, linting
Browse files Browse the repository at this point in the history
  • Loading branch information
claravox committed Dec 11, 2023
1 parent f36a6c8 commit 7b02b41
Show file tree
Hide file tree
Showing 2 changed files with 22 additions and 12 deletions.
2 changes: 2 additions & 0 deletions yoda_eus/app.py
Original file line number Diff line number Diff line change
Expand Up @@ -610,6 +610,8 @@ def static_loader() -> Optional[Response]:
static_dir, asset_name = result
return send_from_directory(static_dir, asset_name)

return None

@ app.url_defaults
def add_cache_buster(endpoint: str, values: Dict[str, str]) -> None:
"""Add cache buster to asset (static) URLs."""
Expand Down
32 changes: 20 additions & 12 deletions yoda_eus/util.py
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
#!/usr/bin/env python3

__copyright__ = 'Copyright (c) 2021-2023, Utrecht University'
__license__ = 'GPLv3, see LICENSE'
__copyright__ = "Copyright (c) 2021-2023, Utrecht University"
__license__ = "GPLv3, see LICENSE"

from os import path
from re import fullmatch
Expand All @@ -11,34 +11,42 @@
from werkzeug.utils import secure_filename


def get_validated_static_path(full_path, request_path, yoda_theme_path, yoda_theme) -> Optional[Tuple[str, str]]:
def get_validated_static_path(
full_path: str, request_path: str, yoda_theme_path: str, yoda_theme: str
) -> Optional[Tuple[str, str]]:
"""
Static files handling - recognisable through '/assets/'
Confirms that input path is valid and return corresponding static path
:param full_path: Full path of request
:param request_path: Short path of request
:param full_path: Full path of request
:param request_path: Short path of request
:param yoda_theme_path: Path to the yoda themes
:param yoda_theme: Name of the chosen theme
:param yoda_theme: Name of the chosen theme
:returns: Tuple of static directory and filename for correct path, None for incorrect path
"""
parts = full_path.split('/')
parts = full_path.split("/")

if len(parts) > 2 and fullmatch('[ -~]*', full_path) is not None and parts[1] == 'assets':
if (
len(parts) > 2
and fullmatch("[ -~]*", full_path) is not None
and parts[1] == "assets"
):
parts = parts[2:-1]
user_static_area = path.join(yoda_theme_path, yoda_theme)
_, asset_name = path.split(request_path)
# Confirm that asset_name is safe
if asset_name != secure_filename(asset_name):
return
return None

static_dir = safe_join(user_static_area + '/static', *parts)
static_dir = safe_join(user_static_area + "/static", *parts)
if not static_dir:
return
return None
user_static_filename = path.join(static_dir, asset_name)

if not path.exists(user_static_filename):

Check failure

Code scanning / CodeQL

Uncontrolled data used in path expression High

This path depends on a
user-provided value
.
static_dir = safe_join('/var/www/yoda/static', *parts)
static_dir = safe_join("/var/www/yoda/static", *parts)

return static_dir, asset_name

return None

0 comments on commit 7b02b41

Please sign in to comment.