From 40573615ecec76a613e6683b23c75fbcf8f4cc5f Mon Sep 17 00:00:00 2001 From: virusdefender Date: Mon, 9 May 2016 20:55:42 +0800 Subject: [PATCH] =?UTF-8?q?=E9=81=BF=E5=85=8D=E5=AD=98=E5=9C=A8=E6=96=87?= =?UTF-8?q?=E4=BB=B6=E9=93=BE=E6=8E=A5,=E5=AF=BC=E8=87=B4=E7=9C=9F?= =?UTF-8?q?=E5=AE=9E=E6=96=87=E4=BB=B6=E8=A2=AB=E6=89=93=E5=8C=85?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ref http://drops.wooyun.org/papers/4762 --- problem/views.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/problem/views.py b/problem/views.py index ba6bf180..7fc351c1 100644 --- a/problem/views.py +++ b/problem/views.py @@ -374,7 +374,8 @@ class TestCaseDownloadAPIView(APIView): zf = zipfile.ZipFile(test_case_zip, "w", zipfile.ZIP_DEFLATED) for filename in os.listdir(test_case_dir): - if self._is_legal_test_case_file_name(filename): + # 避免存在文件链接,导致真实文件被打包 + if self._is_legal_test_case_file_name(filename) and not os.path.islink(os.path.join(test_case_dir, filename)): zf.write(os.path.join(test_case_dir, filename), filename) zf.close()