Opened 20 months ago

Last modified 5 months ago

#26329 new Bug

StaticFilesStorage permits leading slash, CachedStaticFilesStorage doesn't

Reported by: Seán Hayes Owned by:
Component: contrib.staticfiles Version: 1.8
Severity: Normal Keywords:
Cc: matt@… Triage Stage: Accepted
Has patch: no Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no

Description

I got the following email from our staging server:

The joined path (/images/no-image.jpg) is located outside of the base path component (/full-path/collected-static)

Someone was using the following template tag:

{% static "/images/no-image.jpg" as no_image_url %}

I checked to see why our tests didn't raise the same error, and it turns out it only happens with CachedStaticFilesStorage (and likely the other manifest storages), StaticFilesStorage and FileSystemStorage seem to just ignore this error.

Since CachedStaticFilesStorage shouldn't be used during testing, I think the parent classes should raise the same error.

Change History (4)

comment:1 Changed 20 months ago by Tim Graham

Component: Uncategorizedcontrib.staticfiles
Triage Stage: UnreviewedAccepted

As a note to anyone tackling this, it only happens with DEBUG = False.

comment:2 Changed 20 months ago by Matt Deacalion Stevens

Cc: matt@… added
Owner: changed from nobody to Matt Deacalion Stevens
Status: newassigned

comment:3 Changed 18 months ago by David Sanders

If no one knows of a legitimate use case for absolute paths being passed to the static templatetag, it seems like this could be fixed fairly easily by raising a ValueError in the StaticFileStorage url method if the path has a leading slash.

However, while we're on the topic there are some other inconsistencies such as for CachedFileStorage leading spaces (but no initial slash) in DEBUG returns the path with a leading space, where as not in DEBUG chomps the leading space. For StaticFileStorage the leading space is always URL encoded.

Seems like a general 'clean_url' method for StaticFileStorage would be useful, that strips spaces and raises a ValueError for a leading slash.

comment:4 Changed 5 months ago by Matt Deacalion Stevens

Owner: Matt Deacalion Stevens deleted
Status: assignednew
Note: See TracTickets for help on using tickets.
Back to Top