Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def get_absolute_path(self, root, path):
# StaticFileHandler.get always calls this method first, so we use this as the
# place to check the path. Note that now the path seperator is os dependent (\\ on windows)
whitelisted = any(re.fullmatch(pattern, path) for pattern in self.whitelist)
blacklisted = any(re.fullmatch(pattern, path) for pattern in self.blacklist)
if not whitelisted:
raise tornado.web.HTTPError(403, 'File not whitelisted')
if blacklisted:
raise tornado.web.HTTPError(403, 'File blacklisted')
return super(WhiteListFileHandler, self).get_absolute_path(root, path)
# Serving notebook extensions
if self.voila_configuration.enable_nbextensions:
handlers.append(
(
url_path_join(self.server_url, r'/voila/nbextensions/(.*)'),
FileFindHandler,
{
'path': self.nbextensions_path,
'no_cache_paths': ['/'], # don't cache anything in nbextensions
},
)
)
handlers.append(
(
url_path_join(self.server_url, r'/voila/files/(.*)'),
WhiteListFileHandler,
{
'whitelist': self.voila_configuration.file_whitelist,
'blacklist': self.voila_configuration.file_blacklist,
'path': self.root_dir,
},
)
)
tree_handler_conf = {
'voila_configuration': self.voila_configuration
}
if self.notebook_path:
handlers.append((
url_path_join(self.server_url, r'/(.*)'),
VoilaHandler,
{
tree_handler_conf = {
'voila_configuration': voila_configuration
}
web_app.add_handlers(host_pattern, [
(url_path_join(base_url, '/voila/render/(.*)'), VoilaHandler, {
'config': server_app.config,
'nbconvert_template_paths': nbconvert_template_paths,
'voila_configuration': voila_configuration
}),
(url_path_join(base_url, '/voila'), VoilaTreeHandler, tree_handler_conf),
(url_path_join(base_url, '/voila/tree' + path_regex), VoilaTreeHandler, tree_handler_conf),
(url_path_join(base_url, '/voila/static/(.*)'), MultiStaticFileHandler, {'paths': static_paths}),
(
url_path_join(base_url, r'/voila/files/(.*)'),
WhiteListFileHandler,
{
'whitelist': voila_configuration.file_whitelist,
'blacklist': voila_configuration.file_blacklist,
'path': os.path.expanduser(web_app.settings['server_root_dir']),
},
),
])
# Serving notebook extensions
if voila_configuration.enable_nbextensions:
# First look into 'nbextensions_path' configuration key (classic notebook)
# and fall back to default path for nbextensions (jupyter server).
if 'nbextensions_path' in web_app.settings:
nbextensions_path = web_app.settings['nbextensions_path']
else:
nbextensions_path = jupyter_path('nbextensions')