evlli/hass-core
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Changes to filename and path validation (#45529)

Browse source 
Co-authored-by: Paulus Schoutsen <balloob@gmail.com>
This commit is contained in:
Joakim Sørensen 2021-01-26 15:53:21 +01:00 • committed by GitHub
parent 4739e8a207
commit b1c2cde40b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
10 changed files with 127 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

14
homeassistant/components/media_source/local_source.py
View file

@ -10,7 +10,7 @@ from homeassistant.components.media_player.const import MEDIA_CLASS_DIRECTORY
from homeassistant.components.media_player.errors import BrowseError
from homeassistant.components.media_source.error import Unresolvable
from homeassistant.core import HomeAssistant, callback
from homeassistant.util import sanitize_path
from homeassistant.util import raise_if_invalid_filename
from .const import DOMAIN, MEDIA_CLASS_MAP, MEDIA_MIME_TYPES
from .models import BrowseMediaSource, MediaSource, MediaSourceItem, PlayMedia
@ -50,8 +50,10 @@ class LocalSource(MediaSource):
if source_dir_id not in self.hass.config.media_dirs:
raise Unresolvable("Unknown source directory.")
if location != sanitize_path(location):
raise Unresolvable("Invalid path.")
try:
raise_if_invalid_filename(location)
except ValueError as err:
raise Unresolvable("Invalid path.") from err
return source_dir_id, location
@ -189,8 +191,10 @@ class LocalMediaView(HomeAssistantView):
self, request: web.Request, source_dir_id: str, location: str
) -> web.FileResponse:
"""Start a GET request."""
if location != sanitize_path(location):
raise web.HTTPNotFound()
try:
raise_if_invalid_filename(location)
except ValueError as err:
raise web.HTTPBadRequest() from err
if source_dir_id not in self.hass.config.media_dirs:
raise web.HTTPNotFound()