donate-cpu-server: do not serve files outside the result path

test/tools/donate_cpu_server_test.py

@@ -15,3 +15,32 @@ def test_parse_req():
     _test_parse_req("GET /head-uninitvar?pkgs=1 HTTP/1.1", '/head-uninitvar', {'pkgs': '1'})
     _test_parse_req("GET /crash.html?pkgs=1 HTTP/1.1", '/crash.html', {'pkgs': '1'})
     _test_parse_req("GET /head-uninitvar?pkgs=1&pkgs2=2 HTTP/1.1", '/head-uninitvar', {'pkgs': '1', 'pkgs2': '2'})
+
+class _Connection:
+    def __init__(self):
+        self.data = b''
+
+    def send(self, data):
+        self.data += data
+        return len(data)
+
+    def close(self):
+        pass
+
+def _http_get(result_path, url):
+    conn = _Connection()
+    donate_cpu_server.HttpClientThread(conn, 'GET {} HTTP/1.1'.format(url), str(result_path), []).run()
+    return conn.data.decode('utf-8')
+
+def test_file_outside_result_path(tmp_path):
+    result_path = tmp_path / 'donated-results'
+    result_path.mkdir()
+    (result_path / 'pkg').write_text('result data')
+    (tmp_path / 'secret.txt').write_text('secret data')
+
+    resp = _http_get(result_path, '/pkg')
+    assert resp.startswith('HTTP/1.1 200 OK') and resp.endswith('result data')
+
+    resp = _http_get(result_path, '/../secret.txt')
+    assert resp.startswith('HTTP/1.1 404 Not Found')
+    assert 'secret data' not in resp

tools/donate-cpu-server.py

@@ -1275,8 +1275,9 @@ def run(self):
                 text = clientsReport(self.resultPath)
                 httpGetResponse(self.connection, text, 'text/html')
             else:
-                filename = self.resultPath + url
-                if not os.path.isfile(filename):
+                result_path = os.path.normpath(self.resultPath)
+                filename = os.path.normpath(result_path + url)
+                if os.path.commonpath([result_path, filename]) != result_path or not os.path.isfile(filename):
                     print_ts('HTTP/1.1 404 Not Found')
                     self.connection.send(b'HTTP/1.1 404 Not Found\r\n\r\n')
                 else: