#32718: [3.2.1] Issue with assigning file to FileField
-------------------------------------+-------------------------------------
Reporter: Kukosk | Owner: nobody
Type: Bug | Status: new
Component: Database | Version: 3.2
layer (models, ORM) | Keywords: 3.2.1 file model
Severity: Normal | filefield fieldfile
Triage Stage: | Has patch: 1
Unreviewed |
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-------------------------------------+-------------------------------------
I came across this issue today when I was updating Django from 3.2.0 ->
3.2.1.
It's directly caused by:
[https://docs.djangoproject.com/en/3.2/releases/3.2.1/#cve-2021-31542
-potential-directory-traversal-via-uploaded-files]
Starting from 3.2.1, Django requires that only the basename is passed to
`FieldFile.save` method, because otherwise it raises a new exception:
{{{
SuspiciousFileOperation: File name ... includes path elements
}}}
The issue is that in `FileField.pre_save`, a full path is passed to
`FieldFile.save`, causing the exception to be raised.
Correct me if I'm wrong, but file-like objects always contain the full
path to the file in the `name` attribute (the built-in Django `File` class
even uses it to reopen the file if it was closed), and so it seems to be a
bug in Django itself.
Steps to reproduce:
{{{
model_instance.file_attribute = File(open(path, 'rb'))
model_instance.save()
}}}
I also created a PR with the fix:
[https://github.com/django/django/pull/14354]
--
Ticket URL: <https://code.djangoproject.com/ticket/32718>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/049.95f55b9b9e6240cda76b426169d6180f%40djangoproject.com.
