Patched code sample

import pathlib
from aiohttp import web
import os

# This code demonstrates the principles used to fix path traversal and information
# disclosure vulnerabilities in aiohttp's static file handling, such as the one
# described in the user's query (conceptually similar to CVE-2024-23334).
#
# The vulnerability occurred because a URL path starting with a double slash (//)
# could be misinterpreted, causing the path to be treated as absolute instead of
# relative to the static directory root. This could allow an attacker to check for
# the existence of any file or directory on the system.
#
# The fix involves two main steps, highlighted in the code below:
# 1. Sanitize the requested filename to prevent it from being treated as an
#    absolute path.
# 2. After resolving the full path (including handling '..' and symlinks),
#    rigorously verify that the resulting path is still inside the intended
#    static root directory.


async def safe_static_file_handler(request: web.Request) -> web.StreamResponse:
    """
    A handler that safely serves files from a designated static directory,
    incorporating fixes for path traversal vulnerabilities.
    """
    static_root = pathlib.Path(__file__).parent.joinpath("static").resolve()
    
    # Get the raw requested filename from the URL
    raw_filename = request.match_info.get("filename", "")

    # --- FIX PART 1: Prevent the path from being treated as absolute ---
    # By stripping leading slashes, we ensure that the path component is always
    # treated as relative to the static_root. A request for "/static//etc/passwd"
    # will result in `filename_part` being "etc/passwd", not "/etc/passwd".
    # This prevents `pathlib.Path.joinpath` from discarding the static_root.
    filename_part = raw_filename.lstrip("/")

    try:
        # Construct the full, intended path
        file_path = static_root.joinpath(filename_part)

        # Resolve the path to get its canonical representation. This collapses
        # ".." components and follows symbolic links.
        resolved_path = file_path.resolve()

        # --- FIX PART 2: Verify the canonical path is within the root directory ---
        # This is the most critical check. It ensures that even after resolving ".."
        # or symlinks, the final path has not "escaped" the static directory.
        # The `relative_to()` method will raise a ValueError if `resolved_path`
        # is not a subpath of `static_root`.
        resolved_path.relative_to(static_root)

    except (ValueError, FileNotFoundError):
        # ValueError is raised by `relative_to` if the path is outside the root.
        # FileNotFoundError is raised by `resolve` if the path does not exist.
        # In either case, the attacker learns nothing and we return a 403 Forbidden
        # to indicate a disallowed request.
        raise web.HTTPForbidden()

    except Exception:
        # Catch any other potential exceptions and treat them as a forbidden request.
        raise web.HTTPForbidden()

    # If all checks pass and the path points to an actual file, serve it.
    if resolved_path.is_file():
        return web.FileResponse(resolved_path)

    # Do not serve directories or other non-file path types.
    raise web.HTTPForbidden()


def main() -> None:
    """Sets up and runs the web server."""
    # Create a dummy static directory and a file for demonstration
    static_dir = pathlib.Path(__file__).parent.joinpath("static")
    static_dir.mkdir(exist_ok=True)
    static_dir.joinpath("index.html").write_text("<h1>Hello, world!</h1>")
    print(f"Serving files from: {static_dir.resolve()}")
    print("Try accessing:")
    print("  - http://127.0.0.1:8080/static/index.html (should work)")
    print("  - http://127.0.0.1:8080/static/../../[some_system_file] (should be forbidden)")
    print("  - http://127.0.0.1:8080/static//etc/passwd (should be forbidden)")
    
    app = web.Application()
    app.add_routes([
        web.get("/static/{filename:.*}", safe_static_file_handler),
    ])
    web.run_app(app, host="127.0.0.1", port=8080)


if __name__ == "__main__":
    main()