Merge pull request #1116 from AAtomical/fix/localfile-prefix-containment

Fix path-containment bypass in LocalFileHandler.can_show

Author: minrk

nbviewer/providers/local/handlers.py

@@ -99,7 +99,8 @@ def can_show(self, path):
                 os.path.normpath(os.path.join(self.localfile_path, path))
             )
 
-        if not fullpath.startswith(self.localfile_path):
+        prefix = self.localfile_path.rstrip(os.sep) + os.sep
+        if not (fullpath + os.sep).startswith(prefix):
             self.log.warn("Directory traversal attempt: '%s'" % fullpath)
             return False