#Suspicious File Operation

71 messages · Page 1 of 1 (latest)

upbeat mason
#

Hi, I have a problem. How do I need to save the file with custom name at custom path?
With this

default_storage.save(os.path.join(MEMES_DIR, meme_name), meme_file)

I have error about Suspicious File operation - path traversal attempt.

glossy flicker
upbeat mason
glossy flicker
upbeat mason
glossy flicker
#

And?

upbeat mason
#

Same error

glossy flicker
#

Can you share a screenshot?

upbeat mason
#

of error?

glossy flicker
#

Yeah

#

And the jpg file too

upbeat mason
#

Do you have any idea?

glossy flicker
upbeat mason
glossy flicker
#

You could pass the folder name in

glossy flicker
upbeat mason
glossy flicker
glossy flicker
upbeat mason
#

I have searched the whole runet and englishnet, but found no information about the two files that are created

#

@glossy flicker Did you find anything?

glossy flicker
#

Its possible that you're saving it twice

upbeat mason
glossy flicker
upbeat mason
#

Oh you about
#sss = default_storage.save(meme_name, meme_file)
default_storage.open(meme_name, "wb").write(meme_bytes)
?

#

No, I'm still trying to fix it

upbeat mason
glossy flicker
#

sorry I have no clue

outer plume
#

Please stop sharing code as pictures, see #readme-1st for formatting

#

Why are you directly calling storage? You probably saving twice

#

so it automatically adds a hash or random string suffix

upbeat mason
#

And no, i'm saving only once

upbeat mason
upbeat mason
outer plume
outer plume
upbeat mason
#

Okay, well, I found the reason for the double save. But now I don't really understand how it should look like.
In the doc it was written in small text close to the background color in the code comment that this method File creates a file. How can I replace this method?

    def add_meme_to_checklist(author_id, filename, photo_hash):
        with open(os.path.join(settings.BASE_DIR, "memes", filename), "rb") as meme:
            MemeCheck(author_id=author_id, filename=filename, photo_hash=photo_hash, photo=File(meme)).save()
        return True, 201
outer plume
#

What kind of method it is and why you need ita tll

#

And why are you opening something in base dir, you are not uploading a file?

upbeat mason
outer plume
#

Yes, you can

#

Unless I'm missing important catch in what you are trying to do you seem to trying to force some strange way to do a simple thing

#

You don't need methods, and you don't need interaction with storage

#

Forms do everything for you

#

If you are reading files instead of uploading - then it's a different case

upbeat mason
upbeat mason
outer plume
#

You reading it? Why reading it?

#

Also reading it should be obj.file.read() or something like that?

upbeat mason
upbeat mason
outer plume
#

mmm, yeah, right so obj.file.open() FIleField already knows how to interact with it

upbeat mason
#

What i need to write instead of this piece

        with open(os.path.join(settings.BASE_DIR, "memes", filename), "rb") as meme:
            MemeCheck(author_id=author_id, filename=filename, photo_hash=photo_hash, photo=File(meme)).save()
```?
outer plume
#

I don't know what this code supposed to do in the first place. What is MemeCheck class?

#

If you are uploading a file code be like

form = MyUploadForm(request.POST, request.FILES)
of form.is_valid():
    form.save()
#

and if you need to calculate hash, it go into the form or before the form.save()

upbeat mason
#

I was told the right way to do it in another chat, but thank you so much for your help as well. Here's the solution

    def add_meme_to_checklist(author_id, filename, photo_hash):
        MemeCheck(author_id=author_id, filename=filename, photo_hash=photo_hash,
                  photo=os.path.join(settings.MEDIA_ROOT, filename)).save()
        return True, 201
outer plume
#

I still don't know to do what

upbeat mason
outer plume
#

When you are submitting a form, there is only one right way to process it - with django.form class (or serializer in libs like DRF)

#

Other methods may seem to work,but usually a quick way to disaster

#

So without bigger picture I can't tell. Maybe it's OK, maybe fundamentally wrong

#

hm. on other hand, if photo is an ImageField, joining MEDIA_ROOT here is wrong