{"action":"created","issue":{"url":"https://api.github.com/repos/jupyter/nbviewer/issues/473","labels_url":"https://api.github.com/repos/jupyter/nbviewer/issues/473/labels{/name}","comments_url":"https://api.github.com/repos/jupyter/nbviewer/issues/473/comments","events_url":"https://api.github.com/repos/jupyter/nbviewer/issues/473/events","html_url":"https://github.com/jupyter/nbviewer/issues/473","id":90564691,"number":473,"title":"localfile directory traversal","user":{"login":"bburky","id":140526,"avatar_url":"https://avatars.githubusercontent.com/u/140526?v=3","gravatar_id":"","url":"https://api.github.com/users/bburky","html_url":"https://github.com/bburky","followers_url":"https://api.github.com/users/bburky/followers","following_url":"https://api.github.com/users/bburky/following{/other_user}","gists_url":"https://api.github.com/users/bburky/gists{/gist_id}","starred_url":"https://api.github.com/users/bburky/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bburky/subscriptions","organizations_url":"https://api.github.com/users/bburky/orgs","repos_url":"https://api.github.com/users/bburky/repos","events_url":"https://api.github.com/users/bburky/events{/privacy}","received_events_url":"https://api.github.com/users/bburky/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-06-24T04:53:33Z","updated_at":"2015-06-24T09:53:12Z","closed_at":null,"body":"The localfile provider allows directory traversals. A root directory is accepted as a command line argument to nbviewer, but requests are not prevented from escaping this root.\r\n\r\nFor example, when running using the Docker configuration and the `-localfiles=/srv/nbviewer/nbviewer/static` argument added to the nbviewer command, it is possible to access the notebook at `/srv/nbviewer/tests/notebook.ipynb` using the URL http://docker.local:8080/localfile/%2e%2e/tests/notebook.ipynb\r\n\r\n\r\nUse curl to test this (Chrome likes to remove `..` and `%2e%2e` from URLs):\r\n\r\n```\r\n$ curl http://192.168.99.100:8080/localfile/%2e%2e/tests/notebook.ipynb\r\n```\r\n\r\nThe following is logged by nbviewer:\r\n\r\n```\r\n[I 150624 04:37:57 handlers:36] looking for file: '/srv/nbviewer/nbviewer/static/../tests/notebook.ipynb'\r\n[I 150624 04:37:57 base:505] rendering 287 B notebook from ../tests/notebook.ipynb\r\n[I 150624 04:37:57 log:53] 200 GET /localfile/%2e%2e/tests/notebook.ipynb (192.168.99.1) 157.38ms\r\n```\r\n\r\nI realize localfile is documented as \"this can be a security risk\", but it isn't sandboxed to the specified path. It could probably use a stronger warning too."},"comment":{"url":"https://api.github.com/repos/jupyter/nbviewer/issues/comments/114809982","html_url":"https://github.com/jupyter/nbviewer/issues/473#issuecomment-114809982","issue_url":"https://api.github.com/repos/jupyter/nbviewer/issues/473","id":114809982,"user":{"login":"Carreau","id":335567,"avatar_url":"https://avatars.githubusercontent.com/u/335567?v=3","gravatar_id":"","url":"https://api.github.com/users/Carreau","html_url":"https://github.com/Carreau","followers_url":"https://api.github.com/users/Carreau/followers","following_url":"https://api.github.com/users/Carreau/following{/other_user}","gists_url":"https://api.github.com/users/Carreau/gists{/gist_id}","starred_url":"https://api.github.com/users/Carreau/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Carreau/subscriptions","organizations_url":"https://api.github.com/users/Carreau/orgs","repos_url":"https://api.github.com/users/Carreau/repos","events_url":"https://api.github.com/users/Carreau/events{/privacy}","received_events_url":"https://api.github.com/users/Carreau/received_events","type":"User","site_admin":false},"created_at":"2015-06-24T09:53:12Z","updated_at":"2015-06-24T09:53:12Z","body":"I see the need for localfile, and it is oft requested, Though, if localfile\nyou have, you can likely nbconvert locally and have access to last modif\ndate-time to be much more efficient. so --localfile is probably no well\nsuited.\n\nOn Wed, Jun 24, 2015 at 11:42 AM, Phil Elson <notifications@github.com>\nwrote:\n\n> I realize localfile is documented as \"this can be a security risk\", but it\n> isn't sandboxed to the specified path. It could probably use a stronger\n> warning too.\n>\n> Incidentally, I stood up an internal nbviewer over a year ago before\n> localfile existed, and one of the goals of that was to view all files\n> outside of the specified path. Just wanted to point out that that is a\n> desirable thing sometimes, but I agree, a more specific warning might be a\n> good idea here.\n>\n> —\n> Reply to this email directly or view it on GitHub\n> <https://github.com/jupyter/nbviewer/issues/473#issuecomment-114807958>.\n>\n"}}