issue_comments

Table actions

4 rows where issue = 465728430 sorted by updated_at descending

✎ View and edit SQL

This data as json, CSV (advanced)

Suggested facets: created_at (date), updated_at (date)

user 2

author_association 2

issue 1

  • Fix static mounts using relative paths and prevent traversal exploits · 4 ✖
id html_url issue_url node_id user created_at updated_at ▲ author_association body reactions issue performed_via_github_app
510558696 https://github.com/simonw/datasette/pull/554#issuecomment-510558696 https://api.github.com/repos/simonw/datasette/issues/554 MDEyOklzc3VlQ29tbWVudDUxMDU1ODY5Ng== simonw 9599 2019-07-11T16:29:25Z 2019-07-11T16:29:25Z OWNER 
{
    "total_count": 0,
    "+1": 0,
    "-1": 0,
    "laugh": 0,
    "hooray": 0,
    "confused": 0,
    "heart": 0,
    "rocket": 0,
    "eyes": 0
}
 Fix static mounts using relative paths and prevent traversal exploits 465728430  
510542280 https://github.com/simonw/datasette/pull/554#issuecomment-510542280 https://api.github.com/repos/simonw/datasette/issues/554 MDEyOklzc3VlQ29tbWVudDUxMDU0MjI4MA== simonw 9599 2019-07-11T15:47:31Z 2019-07-11T15:47:31Z OWNER

Thanks for this!

The tests are failing for Python 3.5 right now which is strange. https://travis-ci.org/simonw/datasette/jobs/556272017

One failure looks like this: ``` app_client = <tests.fixtures.TestClient object at 0x7fb7803285f8> def test_static(app_client): response = app_client.get("/-/static/app2.css")

  assert response.status == 404

E assert 500 == 404 E + where 500 = <tests.fixtures.TestResponse object at 0x7fb780328a58>.status /home/travis/build/simonw/datasette/tests/test_html.py:56: AssertionError ----------------------------- Captured stderr call ----------------------------- Traceback (most recent call last): File "/home/travis/build/simonw/datasette/datasette/utils/asgi.py", line 100, in call return await view(new_scope, receive, send) File "/home/travis/build/simonw/datasette/datasette/utils/asgi.py", line 303, in inner_static full_path = (Path(root_path) / path).resolve().absolute() File "/opt/python/3.5.6/lib/python3.5/pathlib.py", line 1109, in resolve s = self._flavour.resolve(self) File "/opt/python/3.5.6/lib/python3.5/pathlib.py", line 330, in resolve return _resolve(base, str(path)) or sep File "/opt/python/3.5.6/lib/python3.5/pathlib.py", line 315, in _resolve target = accessor.readlink(newpath) File "/opt/python/3.5.6/lib/python3.5/pathlib.py", line 422, in readlink return os.readlink(path) FileNotFoundError: [Errno 2] No such file or directory: '/home/travis/build/simonw/datasette/datasette/static/app2.css' ``` Maybe an exception was renamed between 3.5 and 3.6?

 
{
    "total_count": 0,
    "+1": 0,
    "-1": 0,
    "laugh": 0,
    "hooray": 0,
    "confused": 0,
    "heart": 0,
    "rocket": 0,
    "eyes": 0
}
 Fix static mounts using relative paths and prevent traversal exploits 465728430  
509629331 https://github.com/simonw/datasette/pull/554#issuecomment-509629331 https://api.github.com/repos/simonw/datasette/issues/554 MDEyOklzc3VlQ29tbWVudDUwOTYyOTMzMQ== abdusco 3243482 2019-07-09T12:51:35Z 2019-07-09T12:51:35Z CONTRIBUTOR

I wanted to add a test for it too, but I've realized it's impossible to test a server process as we cannot get its exit code.

```python

tests/test_cli.py

def test_static_mounts_on_windows(): if sys.platform != "win32": return runner = CliRunner() result = runner.invoke( cli, ["serve", "--static", r"s:C:\"] ) assert result.exit_code == 0 ```

 
{
    "total_count": 0,
    "+1": 0,
    "-1": 0,
    "laugh": 0,
    "hooray": 0,
    "confused": 0,
    "heart": 0,
    "rocket": 0,
    "eyes": 0
}
 Fix static mounts using relative paths and prevent traversal exploits 465728430  
509618339 https://github.com/simonw/datasette/pull/554#issuecomment-509618339 https://api.github.com/repos/simonw/datasette/issues/554 MDEyOklzc3VlQ29tbWVudDUwOTYxODMzOQ== abdusco 3243482 2019-07-09T12:16:32Z 2019-07-09T12:16:32Z CONTRIBUTOR

I've also added another fix for using static mounts with absolute paths on Windows. 

{
    "total_count": 0,
    "+1": 0,
    "-1": 0,
    "laugh": 0,
    "hooray": 0,
    "confused": 0,
    "heart": 0,
    "rocket": 0,
    "eyes": 0
}
 Fix static mounts using relative paths and prevent traversal exploits 465728430  

Advanced export

JSON shape: default, array, newline-delimited, object

CSV options: 

CREATE TABLE [issue_comments] (
   [html_url] TEXT,
   [issue_url] TEXT,
   [id] INTEGER PRIMARY KEY,
   [node_id] TEXT,
   [user] INTEGER REFERENCES [users]([id]),
   [created_at] TEXT,
   [updated_at] TEXT,
   [author_association] TEXT,
   [body] TEXT,
   [reactions] TEXT,
   [issue] INTEGER REFERENCES [issues]([id])
, [performed_via_github_app] TEXT);
CREATE INDEX [idx_issue_comments_issue]
                ON [issue_comments] ([issue]);
CREATE INDEX [idx_issue_comments_user]
                ON [issue_comments] ([user]);