diff --git a/homeassistant/core.py b/homeassistant/core.py index 4fcd938335c..c65566b42fa 100644 --- a/homeassistant/core.py +++ b/homeassistant/core.py @@ -1079,7 +1079,7 @@ class Config(object): """Check if the path is valid for access from outside.""" parent = pathlib.Path(path).parent try: - parent.resolve() # pylint: disable=no-member + parent = parent.resolve() # pylint: disable=no-member except (FileNotFoundError, RuntimeError, PermissionError): return False diff --git a/tests/test_core.py b/tests/test_core.py index f173ad65c41..1d22d17f996 100644 --- a/tests/test_core.py +++ b/tests/test_core.py @@ -821,13 +821,13 @@ class TestConfig(unittest.TestCase): for path in valid: assert self.config.is_allowed_path(path) - self.config.whitelist_external_dirs = set(('/home',)) + self.config.whitelist_external_dirs = set(('/home', '/var')) unvalid = [ "/hass/config/secure", "/etc/passwd", "/root/secure_file", - "/hass/config/test/../../../etc/passwd", + "/var/../etc/passwd", test_file, ] for path in unvalid: