HTTP GM baseline viewer: server should serve files from gm/rebaseline_server dir

gm/rebaseline_server/server.py

 #!/usr/bin/python
 
 '''
 Copyright 2013 Google Inc.
 
 Use of this source code is governed by a BSD-style license that can be
 found in the LICENSE file.
 '''
 
 '''
 HTTP server for our HTML rebaseline viewer.
 '''
 
 # System-level imports
 import argparse
 import BaseHTTPServer
 import json
 import os
 import posixpath
 import re
 import shutil
 import sys
 
 # Imports from within Skia
 #
 # We need to add the 'tools' directory, so that we can import svn.py within
 # that directory.
 # Make sure that the 'tools' dir is in the PYTHONPATH, but add it at the *end*
 # so any dirs that are already in the PYTHONPATH will be preferred.
-TRUNK_DIRECTORY = os.path.dirname(os.path.dirname(os.path.dirname(
-    os.path.realpath(__file__))))
+PARENT_DIRECTORY = os.path.dirname(os.path.realpath(__file__))
+TRUNK_DIRECTORY = os.path.dirname(os.path.dirname(PARENT_DIRECTORY))
 TOOLS_DIRECTORY = os.path.join(TRUNK_DIRECTORY, 'tools')
 if TOOLS_DIRECTORY not in sys.path:
   sys.path.append(TOOLS_DIRECTORY)
 import svn
 
 # Imports from local dir
 import results
 
 ACTUALS_SVN_REPO = 'http://skia-autogen.googlecode.com/svn/gm-actual'
 PATHSPLIT_RE = re.compile('/([^/]+)/(.+)')
@@ skipping 108 matching lines @@
     TODO(epoger): Unless we start making use of result_type, remove that
     parameter."""
     print 'do_GET_results: sending results of type "%s"' % result_type
     response_dict = _SERVER.results.GetAll()
     if response_dict:
       self.send_json_dict(response_dict)
     else:
       self.send_error(404)
 
   def do_GET_static(self, path):
-    """ Handle a GET request for a file under the 'static' directory. """
+    """ Handle a GET request for a file under the 'static' directory.
+    Only allow serving of files within the 'static' directory that is a
+    filesystem sibling of this script. """
     print 'do_GET_static: sending file "%s"' % path
-    self.send_file(posixpath.join('static', path))
+    static_dir = os.path.realpath(os.path.join(PARENT_DIRECTORY, 'static'))

[epoger, 2013/10/02 18:39:56]

Main purpose of this CL: make the server retrieve files from the
gm/rebaseline_server/static directory, regardless of the directory it was run
from.

+    full_path = os.path.realpath(os.path.join(static_dir, path))
+    if full_path.startswith(static_dir):
+      self.send_file(full_path)
+    else:
+      print ('Attempted do_GET_static() of path [%s] outside of static dir [%s]'

[epoger, 2013/10/02 18:39:56]

While I was at it, put in some double-checking to make sure callers cannot
access the filesystem outside of the 'static' subdir.

+             % (full_path, static_dir))
+      self.send_error(404)
 
   def redirect_to(self, url):
     """ Redirect the HTTP client to a different url. """
     self.send_response(301)
     self.send_header('Location', url)
     self.end_headers()
 
   def send_file(self, path):
     """ Send the contents of the file at this path, with a mimetype based
         on the filename extension. """
@@ skipping 46 matching lines @@
                             'defaults to %(default)s'),
                       default=DEFAULT_PORT)
   args = parser.parse_args()
   global _SERVER
   _SERVER = Server(expectations_dir=args.expectations_dir,
                    port=args.port, export=args.export)
   _SERVER.run()
 
 if __name__ == '__main__':
   main()