simplehttpserver: prevent overwriting files outside of document path

slapos/recipe/simplehttpserver/simplehttpserver.py

@@ -57,6 +57,9 @@ class ServerHandler(SimpleHTTPRequestHandler):
 
   def writeFile(self, filename, content, method='ab'):
     file_path = os.path.abspath(os.path.join(self.document_path, filename))
+    if not file_path.startswith(self.document_path):
+      self.respond(403, 'text/plain')
+      self.wfile.write(b"Forbidden")
 
     try:
       os.makedirs(os.path.dirname(file_path))

slapos/test/recipe/test_simplehttpserver.py

@@ -87,3 +87,14 @@ class SimpleHTTPServerTest(unittest.TestCase):
     self.assertIn('hello.txt', requests.get(server_base_url).text)
     self.assertEqual(
         requests.get(server_base_url + '/hello.txt').text, 'hello')
+
+    # incorrect paths are refused
+    for path in '/hello.txt', '../hello.txt':
+      resp = requests.post(
+          server_base_url,
+          files={
+              'path': path,
+              'content': b'hello',
+          },
+      )
+      self.assertEqual(resp.status_code, requests.codes.forbidden)