notebook: fix massive security vulnerability and get rid of all possible "internal server errors" when doing "Data --> Upload or attach file"

[was]

Uploading or attaching an empty file or a file that doesn't exist, etc. can cause internal server errors instead of a proper error message.

Moreover, notice these lines in twist.py:

class Worksheet_do_upload_data
...
        dest = os.path.join(self.worksheet.data_directory(), name)
        if os.path.exists(dest):
            os.unlink(dest)

With a properly crafted URL I bet name could contain .. and hence one could make the notebook *server* delete any file it has access to! This is a critical security vulnerability.

See also #3849 for similar issues when uploading a worksheet.

[was]

Yes, this is fully exploitable and allows one to delete any file on the server: E.g., on my laptop I created a file tmp/xyz, then pasted in this url, and that file was deleted.

http://localhost:8000/home/admin/13/do_upload_data?urlField=%27%27&nameField=../../../../../../../../tmp/xyz

With a little more work, one could not only delete any file, but I think *replace* it by a file of ones choice. That's a pretty massive exploit.

So I'm upping this to a blocker and fixing it now.

[jason]

Can you do a quick grep through the source to see if any os.* functions are used in a like manner in the notebook?

[mpatel]

Creating a new file with name & raises an OSError.

[mpatel]

Replying to mpatel:

Creating a new file with name & raises an OSError.

Actually, clicking to delete this file raises the error:

        exceptions.OSError: [Errno 21] Is a directory: '/home/apps/.sage/sage_notebook.sagenb/home/admin/88/data/'

[mpatel]

Version 2. Minor simplifications. Apply only this patch to sagenb repo.

[mpatel]

I think the OSError above is a separate URI encoding problem.

[mpatel]

Anyway, my digression aside, my review is positive, as far as it goes.

[mpatel]

Replying to mpatel:

I think the OSError above is a separate URI encoding problem.

This is now #7500.

[was]

"Anyway, my digression aside, my review is positive, as far as it goes. " so positive review.

[was]

merged into sage-4.3