51
52
Returns (None, None) if the path is empty.
53
54
>>> stubconfig = {'paths': {'jails': {'mounts': '/jails'}}}
55
>>> url_to_local(stubconfig, '')
55
57
>>> url_to_local(stubconfig, 'joe/foo/bar/baz')
56
58
('joe', '/jails/joe/home/joe/foo/bar/baz')
57
>>> url_to_local(stubconfig, 'joe')
58
('joe', '/jails/joe/home/joe')
59
>>> url_to_local(stubconfig, 'joe/')
60
('joe', '/jails/joe/home/joe')
62
We have some protection from various potential attacks. An empty,
63
absolute, or ..-prefixed path yields a special result.
65
>>> url_to_local(stubconfig, '')
67
>>> url_to_local(stubconfig, '/foo')
69
>>> url_to_local(stubconfig, '../bar')
73
61
# First normalise the path
91
79
return (user, path)
93
def url_to_jailpaths(config, urlpath):
81
def url_to_jailpaths(urlpath):
94
82
"""Given a URL path (part of a URL query string), returns a tuple of
95
83
* the username of the student whose directory is being browsed
96
84
* the absolute path where the jail will be located.
99
87
urlpath: See urlpath in url_to_local.
101
>>> stubconfig = {'paths': {'jails': {'mounts': '/jails'}}}
89
>>> url_to_jailpaths("joe/mydir/myfile")
90
('joe', '/var/lib/ivle/jailmounts/joe', '/home/joe/mydir/myfile')
103
>>> url_to_jailpaths(stubconfig, "joe/mydir//myfile/.././myfile")
104
('joe', '/jails/joe', '/home/joe/mydir/myfile')
105
>>> url_to_jailpaths(stubconfig, "")
107
>>> url_to_jailpaths(stubconfig, "../foo")
109
>>> url_to_jailpaths(stubconfig, "/foo")
92
>>> url_to_jailpaths("")
110
93
(None, None, None)
112
95
# First normalise the path
113
96
urlpath = os.path.normpath(urlpath)
114
# Now if it begins with "..", or is absolute, then it's illegal
115
if urlpath.startswith("..") or os.path.isabs(urlpath):
97
# Now if it begins with ".." then it's illegal
98
if urlpath.startswith(".."):
116
99
return (None, None, None)
117
100
# Note: User can be a group name. There is absolutely no difference in our
118
101
# current directory scheme.
119
102
(user, subpath) = util.split_path(urlpath)
120
103
if user is None: return (None, None, None)
122
jail = os.path.join(config['paths']['jails']['mounts'], user)
105
jail = os.path.join(ivle.conf.jail_base, user)
123
106
path = to_home_path(urlpath)
125
108
return (user, jail, path)
130
113
>>> to_home_path('joe/foo/bar/baz')
131
114
'/home/joe/foo/bar/baz'
132
>>> to_home_path('joe/foo//bar/baz/../../')
134
>>> to_home_path('joe/foo//bar/baz/../../../../../') is None
138
urlpath = os.path.normpath(urlpath)
139
# If it begins with '..', it's illegal.
140
if urlpath.startswith(".."):
143
116
return os.path.join('/home', urlpath)
145
118
def svnpublished(path):