Openstack 路径遍历指南文档有一个损坏的示例什么地方出了错？

如何解决Openstack 路径遍历指南文档有一个损坏的示例什么地方出了错？

https://security.openstack.org/guidelines/dg_using-file-paths.html

如果我尝试从上面的链接运行给定的代码：

import os

def is_safe_path(basedir,path,follow_symlinks=True):
    # resolves symbolic links
    if follow_symlinks:
         matchpath = os.path.realpath(path).startswith(basedir)
    else:
         matchpath = os.path.abspath(path).startswith(basedir)
    return basedir == os.path.commonpath((basedir,matchpath))

is_safe_path('/test','/test/../abc')

它显然不起作用：

$ python
Python 3.8.8 (default,Mar  4 2021,21:24:42)
[GCC 10.2.0] on cygwin
Type "help","copyright","credits" or "license" for more information.
>>> import os
>>>
>>> def is_safe_path(basedir,follow_symlinks=True):
...     # resolves symbolic links
...     if follow_symlinks:
...          matchpath = os.path.realpath(path).startswith(basedir)
...     else:
...          matchpath = os.path.abspath(path).startswith(basedir)
...     return basedir == os.path.commonpath((basedir,matchpath))
...
>>> is_safe_path('/test','/test/../abc')
Traceback (most recent call last):
  File "<stdin>",line 1,in <module>
  File "<stdin>",line 7,in is_safe_path
  File "/usr/lib/python3.8/posixpath.py",line 496,in commonpath
    paths = tuple(map(os.fspath,paths))
TypeError: expected str,bytes or os.pathLike object,not bool

这里的伪代码是什么？应该删除 .startswith() 吗？我是不是完全误解了在元组中使用布尔值的目的是什么？

我找到了更改此内容的编辑：

https://bugs.launchpad.net/ossa/+bug/1815422 https://review.opendev.org/c/openstack/ossa/+/771854/

解决方法

这是代码中的一个错字，.startswith(basedir) 不应该跟在 realpath 或 abspath 后面。老实说，很可能是复制和粘贴问题。我强烈建议您提交问题的修复程序！