Skip to content

Raise BadRequest if static file name is invalid #1763

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
untitaker merged 3 commits into from
Apr 2, 2016
Merged

Raise BadRequest if static file name is invalid #1763

untitaker merged 3 commits into from
Apr 2, 2016

Conversation

@chaosagent
Copy link
Contributor

@chaosagent chaosagent commented Apr 1, 2016

Fixes issue #1761

ThiefMaster
ThiefMaster reviewed Apr 1, 2016
View reviewed changes
flask/helpers.py Outdated
try:
if not os.path.isfile(filename):
raise NotFound()
except TypeError:

This comment was marked as off-topic.

Sign in to view

@chaosagent
Copy link
Contributor Author

chaosagent commented Apr 1, 2016

Thanks for the tips; I'm kinda new to serious software development ;)

ThiefMaster
ThiefMaster reviewed Apr 1, 2016
View reviewed changes
tests/test_helpers.py Outdated
with app.test_request_context():
with pytest.raises(BadRequest):
rv = flask.send_from_directory('static', 'bad\x00')
rv.close()

This comment was marked as off-topic.

Sign in to view

@untitaker
Copy link
Contributor

untitaker commented Apr 1, 2016

LGTM!

@ThiefMaster When merging this, you might want to merge into the 0.10-maintenance branch, and then merge 0.10-maintenance into master, such that we can do a bugfix-release without releasing 1.0. Just make sure you only merge this PRs changes, not all the commits from master.

@chaosagent
Copy link
Contributor Author

chaosagent commented Apr 2, 2016

Should I squash these commits before merge?

@ThiefMaster
Copy link
Member

ThiefMaster commented Apr 2, 2016

yes, please!

@untitaker
Copy link
Contributor

untitaker commented Apr 2, 2016

@ThiefMaster https://github.com/blog/2141-squash-your-commits

On 2 April 2016 08:36:37 CEST, Adrian notifications@github.com wrote:

yes, please!

You are receiving this because you commented.
Reply to this email directly or view it on GitHub:
#1763 (comment)

Sent from my Android device with K-9 Mail. Please excuse my brevity.

@untitaker untitaker merged commit 9f1be8e into pallets:master Apr 2, 2016
@untitaker
Copy link
Contributor

untitaker commented Apr 2, 2016

Awesome, thanks!

untitaker added a commit that referenced this pull request Apr 2, 2016
@untitaker
Changelog for #1763
bd66710
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Nov 14, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

@ThiefMaster ThiefMaster

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@chaosagent @untitaker @ThiefMaster