Confused about the security.safe_join function
masterbbud opened this issue · comments
I'm using werkzeug's utils.send_from_directory()
function to send a file with a multilevel "path" value. For example, my call to send_from_directory()
might look like:
send_from_directory("C:\directory", "subdir\file.html", environment)
In this case, send_from_directory
returns a 404 NotFound
, since the call to safe_join
in line 564 returns None.
# utils.send_from_directory: 564
path_str = safe_join(os.fspath(directory), os.fspath(path))
The call to safe_join
is rejected because the subpath contains a \
character, which is included in the list of _os_alt_seps
(defined in security.py) to mark it as "insecure".
This seems incorrect. Why is the separator /
manually ignored from the _os_alt_seps
definition in line 13, but not \
? It's important to note that I'm running on Windows, and \
is the default path separator. I believe that a single slash \
in the path to join in should not be considered an "unsafe" access - but correct me if this is an incorrect assumption.
The second path in send_from_directory
would be a URL path, not an OS path. URL paths are separated by /
.