新型任意文件读取漏洞的研究

def do_GET(self):
    if self.path.startswith('/static/'):
        SimpleHTTPServer.SimpleHTTPRequestHandler.do_GET(self)
    else:
        self.run_wsgi_app()

#!/usr/bin/python
import web

urls = (
    '/uploadfile/(.*)', 'download',
    '/', 'hello',
)
app = web.application(urls, globals())

class hello:        
    def GET(self, name):
        if not name: 
            name = 'World'
        return 'Hello, ' + name + '!'

class download:
    def GET(self, filepath):
        try:
            with open("./uploadfile/%s" % filepath, "rb") as f:
                content = f.read()
            return content
        except:
            return web.notfound("Sorry, the file you were looking for was not found.")

if __name__ == "__main__":
    app.run()

def validate_absolute_path(self, root, absolute_path):
    """Validate and return the absolute path.

    ``root`` is the configured path for the `StaticFileHandler`,
    and ``path`` is the result of `get_absolute_path`

    This is an instance method called during request processing,
    so it may raise `HTTPError` or use methods like
    `RequestHandler.redirect` (return None after redirecting to
    halt further processing).  This is where 404 errors for missing files
    are generated.

    This method may modify the path before returning it, but note that
    any such modifications will not be understood by `make_static_url`.

    In instance methods, this method's result is available as
    ``self.absolute_path``.

    .. versionadded:: 3.1
    """
    root = os.path.abspath(root)
    # os.path.abspath strips a trailing /
    # it needs to be temporarily added back for requests to root/
    if not (absolute_path + os.path.sep).startswith(root):
        raise HTTPError(403, "%s is not in root static directory",
                        self.path)
    if (os.path.isdir(absolute_path) and
            self.default_filename is not None):
        # need to look at the request.path here for when path is empty
        # but there is some prefix to the path that was already
        # trimmed by the routing
        if not self.request.path.endswith("/"):
            self.redirect(self.request.path + "/", permanent=True)
            return
        absolute_path = os.path.join(absolute_path, self.default_filename)
    if not os.path.exists(absolute_path):
        raise HTTPError(404)
    if not os.path.isfile(absolute_path):
        raise HTTPError(403, "%s is not a file", self.path)
    return absolute_path

application = web.Application([
    (r"/uploadfile/(.*)", web.StaticFileHandler, {"path": "/var/www"}),
])

from django.shortcuts import render
from django.http import HttpResponse

# Create your views here.

def index(request, path):
    with open(path, "rb") as f:
        content = f.read()
    return HttpResponse(content)

from django.shortcuts import render
from django.http import HttpResponse
from django.http import Http404
import os

# Create your views here.

def index(request, path):
    static = "uploadfile"
    root = os.path.join(os.getcwd(), static) + os.path.sep
    path = os.path.abspath(root + path)
    if not (path).startswith(root):
        raise Http404
    else:
        with open(path, "rb") as f:
            content = f.read()
        return HttpResponse(content)

if (isset($_SERVER['SERVER_SOFTWARE']) && (strpos($_SERVER['SERVER_SOFTWARE'], 'Microsoft-IIS') !== false) && (isset($_GET['rewrite']) == true)){
    //iis+httpd.ini下如果存在真实文件
    $realurl = $zbp->path . urldecode($url);
    if(is_readable($realurl)&&is_file($realurl)){
        die(file_get_contents($realurl));
    }
    unset($realurl);
}