3 ms·
Oh, and thanks to urllib.unquote, I can disguise slashes as "%2f", so the tightened regexp doesn't help.
by jwilk 10y ago
Oh, and thanks to urllib.unquote, I can disguise slashes as "%2f", so the tightened regexp doesn't help.
- jwilk 10y agoNever mind me, I misread how this function is used. Apparently this code was copied from stdlib, including a different directory traversal bug on Windows: https://bugs.python.org/issue26657 https://bugs.python.org/issue26657