Skip to content

Commit 9965f16

Browse files
fix: 404 error on retrieving snippet content in symlinked dir
os.path.realpath also resolves symlinks. We only want to resolve '..' to prevent escaping the snippet roots, os.path.abspath does this. This commit also adds some logging be able to better analyze other potential problems.
1 parent 03bbaea commit 9965f16

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

jupyterlab-snippets/loader.py

+4-1
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,15 @@ def get_snippet_content(self, snippet):
3030
path = os.path.join(root_path, *snippet)
3131

3232
# Prevent access to the entire file system when the path contains '..'
33-
accessible = os.path.realpath(path).startswith(root_path)
33+
accessible = os.path.abspath(path).startswith(root_path)
34+
if not accessible:
35+
print(f'jupyterlab-snippets: {path} not accessible from {root_path}')
3436

3537
if accessible and os.path.isfile(path):
3638
with open(path) as f:
3739
return f.read()
3840
except:
3941
raise tornado.web.HTTPError(status_code=500)
4042

43+
print(f'jupyterlab-snippets: {snippet} not found in {self.snippet_paths}')
4144
raise tornado.web.HTTPError(status_code=404)

0 commit comments

Comments
 (0)