Fix: prevent to traverse up the root directory

TODO.md

@@ -1,7 +1,6 @@
 # Now
-- command line argument to set any option
-- all todos
-- all fixmes
+- readme
+- header is too large, decrease the header size
 
 ## later
-- readme
+# cache assets

tests/test_server.py

@@ -102,3 +102,13 @@ def test_server_notfound(ymdapp, ymdserver, mockupfs):
 
         when(url='/bar.md')
         assert status == 404
+
+
+def test_server_unauthorized(ymdapp, ymdserver, mockupfs):
+    root = mockupfs(**{
+        'index.md': '# index',
+    })
+    ymdapp.settings.root = root
+    ymdapp.ready()
+    with ymdserver('/../foo'):
+        assert status == 403

yhttp/markdown/server.py

@@ -66,7 +66,6 @@ def info(req):
     )
 
 
-# TODO: cache
 @app.route('/index.css')
 @sass
 def get(req, path=None):
@@ -102,7 +101,9 @@ def notfound(req, path, **kw):
 
 @y.html
 def get(req, path=None):
-    # FIXME: (security) prevent to get parent directories
+    if '..' in path:
+        raise y.statuses.forbidden()
+
     targetpath = os.path.join(cfg.root, path or '')
     targetfile = None
 

yhttp/markdown/toc.py

@@ -74,7 +74,6 @@ def extractdir(root, directory, depth=6):
     subdirs = []
     root = os.path.abspath(root)
 
-    # FIXME: prevent to traverse up
     dirpath = os.path.join(root, directory)
     for item in sorted(os.listdir(dirpath)):
         if SYSFILES.match(item):