CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-06-12 11:16:55 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Minor patch

Browse source
This commit is contained in:
Miroslav Štampar 2026-06-04 21:34:11 +02:00
parent b67ea8f294
commit 3e8a69cfbe
3 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/utils/api.py
View file

@ -660,7 +660,7 @@ def download(taskid, target, filename):
path = os.path.abspath(os.path.join(paths.SQLMAP_OUTPUT_PATH, target, filename))
# Prevent file path traversal
if not path.startswith(paths.SQLMAP_OUTPUT_PATH):
if not path.startswith(os.path.join(paths.SQLMAP_OUTPUT_PATH, "")):
logger.warning("[%s] Forbidden path (%s)" % (taskid, target))
return jsonize({"success": False, "message": "Forbidden path"})