static file register arbitrary file read

[yeahx]

File sanic/sanic/static.py line 46
we can see here is security check

43    async def _handler(request, file_uri=None):
44        # Using this to determine if the URL is trying to break out of the path
45        # served.  os.path.realpath seems to be very slow
46        if file_uri and '../' in file_uri:
47            raise InvalidUsage("Invalid URL")

but at the line 56 in this file,the unquote function decoded file_path
file_path = unquote(file_path)
we only need to "/" url coding can bypass the previous security check
like this:

example of vulnerabilities:

#!/usr/bin/env python
#-*- coding:utf-8 -*-
#author: lazyago@gmail.com
from sanic import Sanic
from sanic.response import text


app = Sanic()

app.static('/static', '/var/tmp')

@app.route("/")
async def test(request):
    return text('Hello!')

if __name__ == '__main__':
    app.run(host='127.0.0.1', port=8787, debug=True)

[go2sh]

Autsch.

[seemethere]

Closed with #635