diff --git a/jupyterlab-snippets/_version.py b/jupyterlab-snippets/_version.py index 0f60a47..4c7a37e 100644 --- a/jupyterlab-snippets/_version.py +++ b/jupyterlab-snippets/_version.py @@ -1,2 +1,2 @@ -version_info = (0, 3, 1) +version_info = (0, 3, 2) __version__ = ".".join(map(str, version_info)) diff --git a/jupyterlab-snippets/loader.py b/jupyterlab-snippets/loader.py index 1cd5f1f..f769ff4 100644 --- a/jupyterlab-snippets/loader.py +++ b/jupyterlab-snippets/loader.py @@ -30,7 +30,9 @@ def get_snippet_content(self, snippet): path = os.path.join(root_path, *snippet) # Prevent access to the entire file system when the path contains '..' - accessible = os.path.realpath(path).startswith(root_path) + accessible = os.path.abspath(path).startswith(root_path) + if not accessible: + print(f'jupyterlab-snippets: {path} not accessible from {root_path}') if accessible and os.path.isfile(path): with open(path) as f: @@ -38,4 +40,5 @@ def get_snippet_content(self, snippet): except: raise tornado.web.HTTPError(status_code=500) + print(f'jupyterlab-snippets: {snippet} not found in {self.snippet_paths}') raise tornado.web.HTTPError(status_code=404) diff --git a/package.json b/package.json index 063ca3f..0a0b671 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "jupyterlab-snippets", - "version": "0.3.1", + "version": "0.3.2", "description": "Snippets Extension for JupyterLab", "keywords": [ "jupyter",