thumbor / thumbor / 26696628394

89%

push

github

fix(file_loader): enforce root boundaries after decoding paths

Decode percent-encoded paths before root-boundary validation to block
%2e%2e traversal through filters such as watermark and frame.

Replace the startswith() guard with os.path.commonpath() so sibling prefixes
outside FILE_LOADER_ROOT_PATH are not accepted.

Preserve compatibility for literal percent-encoded filenames by trying the
raw path only after a repeated root-boundary check. Add tests for encoded
traversal, mixed traversal, sibling-prefix escape, and normal file loading.

10 of 12 new or added lines in 1 file covered. (83.33%)

3912 of 4401 relevant lines covered (88.89%)

4.44 hits per line