RetroSearch Browse

Sat Nov 4 17:09:11 CET 2006 · https://mail.python.org/pipermail/python-dev/2006-November/069823.html

On 11/3/06, Steve Holden <steve at holdenweb.com> wrote:
> Having said this, Andrew *did* demonstrate quite convincingly that the
> current urljoin has some fairly egregious directory traversal glitches.
> Is it really right to punt obvious gotchas like
>
>  >>>urlparse.urljoin("http://blah.com/a/b/c", "../../../../")
>
> 'http://blah.com/../../'

Ah, but how do you know when that's wrong? At least under ftp:// your
root is often a mid-level directory until you change up out of it.
http:// will tend to treat the targets as roots, but I don't know that
there's any requirement for a /.. to be meaningless (even if it often
is).

-- 
Michael Urman  http://www.tortall.net/../mu/blog ;)

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from https://mail.python.org/pipermail/python-dev/2006-November/069823.html below:

[Python-Dev] Path object design