Python中文件读取操作漏洞深度解析与防护指南

# 危险示例
import os
from flask import send_file

@app.route('/download')
def download():
    filename = request.args.get('file')
    path = os.path.join("static/files", filename)
    return send_file(path)

>>> os.path.join("/a", "/b")  # 第二个绝对路径会完全覆盖第一个
'/b'
>>> os.path.join("static/files", "../../etc/passwd")  # 相对路径穿越
'static/files/../../etc/passwd'

# 危险示例：日志查看功能
@app.route('/view_log')
def view_log():
    log_date = request.args.get('date')  # 如2023-01-01
    log_file = f"/var/log/app/{log_date}.log"
    with open(log_file, 'r') as f:
        return f.read()

# 危险示例：使用zipfile模块但不检查路径
import zipfile

with zipfile.ZipFile("upload.zip", 'r') as zip_ref:
    zip_ref.extractall("uploads/")

# 危险示例：Jinja2模板注入
from flask import render_template_string

@app.route('/greet')
def greet():
    name = request.args.get('name', 'Guest')
    template = f"Hello, {name}!"
    return render_template_string(template)

import pickle

# 危险示例：反序列化用户数据
data = request.cookies.get('data')
obj = pickle.loads(base64.b64decode(data))

from lxml import etree

# 危险示例：解析XML时不禁用实体
xml_data = request.body
doc = etree.fromstring(xml_data)

import os
from pathlib import Path

def safe_join(base_dir, user_path):
    # 转换为绝对路径并规范化
    base = Path(base_dir).resolve()
    try:
        path = (base / user_path).resolve()
        # 确保最终路径仍在基目录下
        path.relative_to(base)
        return str(path)
    except (ValueError, RuntimeError):
        raise ValueError("非法路径")

import re
if not re.match(r'^[a-zA-Z0-9_-]+\.log$', filename):
    raise ValueError("非法文件名")

def safe_extract(zip_path, extract_to):
    with zipfile.ZipFile(zip_path) as z:
        for info in z.infolist():
            # 检查是否有路径穿越
            dest = os.path.join(extract_to, info.filename)
            if not os.path.realpath(dest).startswith(os.path.realpath(extract_to)):
                raise ValueError("非法压缩包内容")
            z.extract(info, extract_to)