codalab/codalab-cli — pull request #22 by javierluraschi (2014-04-24 21:25:34+00:00)
Title: Validate file system access by bundle

Found that it is possible to retrieve any file in the system by using relative paths through the file system RPC and web site.

Consider for instance the following URLs to retrieve a config file or the database (when SQLite is used):
http://localhost:8000/api/bundles/filecontent/0xef98ccb37e0d42789ef3aa3fa4df1b85/..%2F..%2Fconfig.json
http://localhost:8000/api/bundles/filecontent/0xef98ccb37e0d42789ef3aa3fa4df1b85/..%2F..%2Fbundle.db

The fix is to validate the bundle path before retrieving a bundle file.

![fileservermissingvalidation](https://cloud.githubusercontent.com/assets/3478847/2795192/b3476764-cbf6-11e3-9567-01047c5d21bc.png)

![fileservermissingvalidation2](https://cloud.githubusercontent.com/assets/3478847/2795193/b3477f6a-cbf6-11e3-90e0-30f36871c3d6.png)