HTTP GM baseline viewer: server should serve files from gm/rebaseline_server dir

gm/rebaseline_server/server.py

Index: gm/rebaseline_server/server.py
===================================================================
--- gm/rebaseline_server/server.py	(revision 11573)
+++ gm/rebaseline_server/server.py	(working copy)
@@ -27,8 +27,8 @@
 # that directory.
 # Make sure that the 'tools' dir is in the PYTHONPATH, but add it at the *end*
 # so any dirs that are already in the PYTHONPATH will be preferred.
-TRUNK_DIRECTORY = os.path.dirname(os.path.dirname(os.path.dirname(
-    os.path.realpath(__file__))))
+PARENT_DIRECTORY = os.path.dirname(os.path.realpath(__file__))
+TRUNK_DIRECTORY = os.path.dirname(os.path.dirname(PARENT_DIRECTORY))
 TOOLS_DIRECTORY = os.path.join(TRUNK_DIRECTORY, 'tools')
 if TOOLS_DIRECTORY not in sys.path:
   sys.path.append(TOOLS_DIRECTORY)
@@ -157,9 +157,18 @@
       self.send_error(404)
 
   def do_GET_static(self, path):
-    """ Handle a GET request for a file under the 'static' directory. """
+    """ Handle a GET request for a file under the 'static' directory.
+    Only allow serving of files within the 'static' directory that is a
+    filesystem sibling of this script. """
     print 'do_GET_static: sending file "%s"' % path
-    self.send_file(posixpath.join('static', path))
+    static_dir = os.path.realpath(os.path.join(PARENT_DIRECTORY, 'static'))

[epoger, 2013/10/02 18:39:56]

Main purpose of this CL: make the server retrieve files from the
gm/rebaseline_server/static directory, regardless of the directory it was run
from.

+    full_path = os.path.realpath(os.path.join(static_dir, path))
+    if full_path.startswith(static_dir):
+      self.send_file(full_path)
+    else:
+      print ('Attempted do_GET_static() of path [%s] outside of static dir [%s]'

[epoger, 2013/10/02 18:39:56]

While I was at it, put in some double-checking to make sure callers cannot
access the filesystem outside of the 'static' subdir.

+             % (full_path, static_dir))
+      self.send_error(404)
 
   def redirect_to(self, url):
     """ Redirect the HTTP client to a different url. """