{"html_url": "https://github.com/simonw/datasette/issues/1124#issuecomment-738209642", "issue_url": "https://api.github.com/repos/simonw/datasette/issues/1124", "id": 738209642, "node_id": "MDEyOklzc3VlQ29tbWVudDczODIwOTY0Mg==", "user": {"value": 9599, "label": "simonw"}, "created_at": "2020-12-03T18:39:19Z", "updated_at": "2020-12-03T18:39:19Z", "author_association": "OWNER", "body": "The CSS files are in the expected location:\r\n```\r\n[ec2-user@ip-172-31-30-7 ~]$ find /home/ec2-user/.local/pipx/venvs/datasette | grep css\r\n/home/ec2-user/.local/pipx/venvs/datasette/lib/python3.7/site-packages/datasette/static/app.css\r\n/home/ec2-user/.local/pipx/venvs/datasette/lib/python3.7/site-packages/datasette/static/codemirror-5.57.0.min.css\r\n```\r\nWow it's running an ANCIENT version of SQLite:\r\n```\r\n[ec2-user@ip-172-31-30-7 ~]$ datasette --get /-/versions.json\r\n{\"python\": {\"version\": \"3.7.9\", \"full\": \"3.7.9 (default, Aug 27 2020, 21:58:41) \\n[GCC 7.3.1 20180712 (Red Hat 7.3.1-9)]\"}, \"datasette\": {\"version\": \"0.52.2\"}, \"asgi\": \"3.0\", \"uvicorn\": \"0.12.3\", \"sqlite\": {\"version\": \"3.7.17\", \"fts_versions\": [\"FTS4\", \"FTS3\"], \"extensions\": {}, \"compile_options\": [\"DISABLE_DIRSYNC\", \"ENABLE_COLUMN_METADATA\", \"ENABLE_FTS3\", \"ENABLE_RTREE\", \"ENABLE_UNLOCK_NOTIFY\", \"SECURE_DELETE\", \"TEMP_STORE=1\", \"THREADSAFE=1\"]}}\r\n```\r\nhttp://www.sqlite.org/releaselog/3_7_17.html - SQLite Release 3.7.17 On 2013-05-20", "reactions": "{\"total_count\": 0, \"+1\": 0, \"-1\": 0, \"laugh\": 0, \"hooray\": 0, \"confused\": 0, \"heart\": 0, \"rocket\": 0, \"eyes\": 0}", "issue": {"value": 756439516, "label": "Datasette on Amazon Linux on ARM returns 404 for static assets"}, "performed_via_github_app": null}
{"html_url": "https://github.com/simonw/datasette/issues/1124#issuecomment-738211152", "issue_url": "https://api.github.com/repos/simonw/datasette/issues/1124", "id": 738211152, "node_id": "MDEyOklzc3VlQ29tbWVudDczODIxMTE1Mg==", "user": {"value": 9599, "label": "simonw"}, "created_at": "2020-12-03T18:42:12Z", "updated_at": "2020-12-03T18:42:12Z", "author_association": "OWNER", "body": "Added a line to print out `app_root` from https://github.com/simonw/datasette/blob/e048791a9a2686f47d81a2c8aa88aa1966d82521/datasette/app.py#L848-L853\r\n```\r\napp_root =  /home/ec2-user/.local/pipx/venvs/datasette/lib64/python3.7/site-packages\r\n```", "reactions": "{\"total_count\": 0, \"+1\": 0, \"-1\": 0, \"laugh\": 0, \"hooray\": 0, \"confused\": 0, \"heart\": 0, \"rocket\": 0, \"eyes\": 0}", "issue": {"value": 756439516, "label": "Datasette on Amazon Linux on ARM returns 404 for static assets"}, "performed_via_github_app": null}
{"html_url": "https://github.com/simonw/datasette/issues/1124#issuecomment-738211776", "issue_url": "https://api.github.com/repos/simonw/datasette/issues/1124", "id": 738211776, "node_id": "MDEyOklzc3VlQ29tbWVudDczODIxMTc3Ng==", "user": {"value": 9599, "label": "simonw"}, "created_at": "2020-12-03T18:43:21Z", "updated_at": "2020-12-03T18:43:21Z", "author_association": "OWNER", "body": "I'm suspicious of this code here:https://github.com/simonw/datasette/blob/e048791a9a2686f47d81a2c8aa88aa1966d82521/datasette/utils/asgi.py#L284-L307", "reactions": "{\"total_count\": 0, \"+1\": 0, \"-1\": 0, \"laugh\": 0, \"hooray\": 0, \"confused\": 0, \"heart\": 0, \"rocket\": 0, \"eyes\": 0}", "issue": {"value": 756439516, "label": "Datasette on Amazon Linux on ARM returns 404 for static assets"}, "performed_via_github_app": null}
{"html_url": "https://github.com/simonw/datasette/issues/1124#issuecomment-738213342", "issue_url": "https://api.github.com/repos/simonw/datasette/issues/1124", "id": 738213342, "node_id": "MDEyOklzc3VlQ29tbWVudDczODIxMzM0Mg==", "user": {"value": 9599, "label": "simonw"}, "created_at": "2020-12-03T18:46:22Z", "updated_at": "2020-12-03T21:40:51Z", "author_association": "OWNER", "body": "I replaced that function with this code:\r\n```python\r\ndef asgi_static(root_path, chunk_size=4096, headers=None, content_type=None):\r\n    async def inner_static(request, send):\r\n        path = request.scope[\"url_route\"][\"kwargs\"][\"path\"]\r\n        print(\"path =\", path)\r\n        try:\r\n            full_path = (Path(root_path) / path).resolve().absolute()\r\n        except FileNotFoundError as e:\r\n            print(\"FileNotFoundError:\", e)\r\n            await asgi_send_html(send, \"404\", 404)\r\n            return\r\n        if full_path.is_dir():\r\n            await asgi_send_html(send, \"403: Directory listing is not allowed\", 403)\r\n            return\r\n        # Ensure full_path is within root_path to avoid weird \"../\" tricks\r\n        try:\r\n            print(\"full_path={}, root_path={}\".format(full_path, root_path))\r\n            full_path.relative_to(root_path)\r\n        except ValueError as e:\r\n            print(\"  ValueError:\", e)\r\n            await asgi_send_html(send, \"404\", 404)\r\n            return\r\n        try:\r\n            await asgi_send_file(send, full_path, chunk_size=chunk_size)\r\n        except FileNotFoundError:\r\n            await asgi_send_html(send, \"404\", 404)\r\n            return\r\n\r\n    return inner_static\r\n```\r\nEdited using `vi /home/ec2-user/.local/pipx/venvs/datasette/lib/python3.7/site-packages/datasette/utils/asgi.py`\r\n\r\nThe output shows me what the bug is:\r\n```\r\n$ datasette --get /-/static/app.css --pdb\r\napp_root =  /home/ec2-user/.local/pipx/venvs/datasette/lib64/python3.7/site-packages\r\npath = app.css\r\nfull_path=/home/ec2-user/.local/pipx/venvs/datasette/lib/python3.7/site-packages/datasette/static/app.css, root_path=/home/ec2-user/.local/pipx/venvs/datasette/lib64/python3.7/site-packages/datasette/static\r\n  ValueError: '/home/ec2-user/.local/pipx/venvs/datasette/lib/python3.7/site-packages/datasette/static/app.css' does not start with '/home/ec2-user/.local/pipx/venvs/datasette/lib64/python3.7/site-packages/datasette/static'\r\n404\r\n```\r\n`  ValueError: '/home/ec2-user/.local/pipx/venvs/datasette/lib/python3.7/site-packages/datasette/static/app.css' does not start with '/home/ec2-user/.local/pipx/venvs/datasette/lib64/python3.7/site-packages/datasette/static'`\r\n\r\nOne is `../lib/python3.7/..` and the other is `../lib64/python3.7/..` - there's clearly some kind of symlink in play here which I'm not taking into account.", "reactions": "{\"total_count\": 0, \"+1\": 0, \"-1\": 0, \"laugh\": 0, \"hooray\": 0, \"confused\": 0, \"heart\": 0, \"rocket\": 0, \"eyes\": 0}", "issue": {"value": 756439516, "label": "Datasette on Amazon Linux on ARM returns 404 for static assets"}, "performed_via_github_app": null}
{"html_url": "https://github.com/simonw/datasette/issues/1124#issuecomment-738215487", "issue_url": "https://api.github.com/repos/simonw/datasette/issues/1124", "id": 738215487, "node_id": "MDEyOklzc3VlQ29tbWVudDczODIxNTQ4Nw==", "user": {"value": 9599, "label": "simonw"}, "created_at": "2020-12-03T18:50:26Z", "updated_at": "2020-12-03T21:41:25Z", "author_association": "OWNER", "body": "This fix works - calling `.resolve()` on the `root_path` before the comparison to ensure symlinks are resolved:\r\n```python\r\n        # Ensure full_path is within root_path to avoid weird \"../\" tricks\r\n        try:\r\n            print(\"full_path={}, root_path={}\".format(full_path, root_path))\r\n            full_path.relative_to(root_path.resolve())\r\n        except ValueError as e:\r\n            print(\"  ValueError:\", e)\r\n            await asgi_send_html(send, \"404\", 404)\r\n            return\r\n```", "reactions": "{\"total_count\": 0, \"+1\": 0, \"-1\": 0, \"laugh\": 0, \"hooray\": 0, \"confused\": 0, \"heart\": 0, \"rocket\": 0, \"eyes\": 0}", "issue": {"value": 756439516, "label": "Datasette on Amazon Linux on ARM returns 404 for static assets"}, "performed_via_github_app": null}
{"html_url": "https://github.com/simonw/datasette/issues/1124#issuecomment-738215686", "issue_url": "https://api.github.com/repos/simonw/datasette/issues/1124", "id": 738215686, "node_id": "MDEyOklzc3VlQ29tbWVudDczODIxNTY4Ng==", "user": {"value": 9599, "label": "simonw"}, "created_at": "2020-12-03T18:50:48Z", "updated_at": "2020-12-03T21:42:02Z", "author_association": "OWNER", "body": "I'm going to punt on writing a unit test for this (not sure how I'd simulate those symlinks) - I'll manually test it and push out a dot release instead.", "reactions": "{\"total_count\": 0, \"+1\": 0, \"-1\": 0, \"laugh\": 0, \"hooray\": 0, \"confused\": 0, \"heart\": 0, \"rocket\": 0, \"eyes\": 0}", "issue": {"value": 756439516, "label": "Datasette on Amazon Linux on ARM returns 404 for static assets"}, "performed_via_github_app": null}
{"html_url": "https://github.com/simonw/datasette/issues/1124#issuecomment-738220067", "issue_url": "https://api.github.com/repos/simonw/datasette/issues/1124", "id": 738220067, "node_id": "MDEyOklzc3VlQ29tbWVudDczODIyMDA2Nw==", "user": {"value": 9599, "label": "simonw"}, "created_at": "2020-12-03T18:58:17Z", "updated_at": "2020-12-03T18:58:17Z", "author_association": "OWNER", "body": "I tested this by running:\r\n\r\n    pipx uninstall datasette\r\n    pipx install 'https://github.com/simonw/datasette/archive/6b4c55efea3e9d34d92cbe5f0066553ad9b14071.zip'\r\n\r\nTo replace that version of Datasette (in the correct virtual environment) with this patch. It worked!\r\n\r\n```\r\n[ec2-user@ip-172-31-30-7 ~]$ datasette --get /-/static/app.css\r\n/* Reset and Page Setup ==================================================== */\r\n...\r\n```", "reactions": "{\"total_count\": 0, \"+1\": 0, \"-1\": 0, \"laugh\": 0, \"hooray\": 0, \"confused\": 0, \"heart\": 0, \"rocket\": 0, \"eyes\": 0}", "issue": {"value": 756439516, "label": "Datasette on Amazon Linux on ARM returns 404 for static assets"}, "performed_via_github_app": null}
{"html_url": "https://github.com/simonw/datasette/issues/1124#issuecomment-738224865", "issue_url": "https://api.github.com/repos/simonw/datasette/issues/1124", "id": 738224865, "node_id": "MDEyOklzc3VlQ29tbWVudDczODIyNDg2NQ==", "user": {"value": 9599, "label": "simonw"}, "created_at": "2020-12-03T19:01:52Z", "updated_at": "2020-12-03T19:01:52Z", "author_association": "OWNER", "body": "https://github.com/simonw/datasette/runs/1494631261\r\n```\r\n/home/runner/work/datasette/datasette/tests/test_html.py:81: AssertionError\r\n----------------------------- Captured stderr call -----------------------------\r\nTraceback (most recent call last):\r\n  File \"/home/runner/work/datasette/datasette/datasette/app.py\", line 1039, in route_path\r\n    response = await view(request, send)\r\n  File \"/home/runner/work/datasette/datasette/datasette/utils/asgi.py\", line 297, in inner_static\r\n    full_path.relative_to(root_path.resolve())\r\nAttributeError: 'str' object has no attribute 'resolve'\r\n```", "reactions": "{\"total_count\": 0, \"+1\": 0, \"-1\": 0, \"laugh\": 0, \"hooray\": 0, \"confused\": 0, \"heart\": 0, \"rocket\": 0, \"eyes\": 0}", "issue": {"value": 756439516, "label": "Datasette on Amazon Linux on ARM returns 404 for static assets"}, "performed_via_github_app": null}
{"html_url": "https://github.com/simonw/datasette/issues/1124#issuecomment-738313399", "issue_url": "https://api.github.com/repos/simonw/datasette/issues/1124", "id": 738313399, "node_id": "MDEyOklzc3VlQ29tbWVudDczODMxMzM5OQ==", "user": {"value": 9599, "label": "simonw"}, "created_at": "2020-12-03T21:10:54Z", "updated_at": "2020-12-03T21:10:54Z", "author_association": "OWNER", "body": "Confirmed that installing a fresh copy of Datasette 0.52.3 on that server works correctly as expected.", "reactions": "{\"total_count\": 0, \"+1\": 0, \"-1\": 0, \"laugh\": 0, \"hooray\": 0, \"confused\": 0, \"heart\": 0, \"rocket\": 0, \"eyes\": 0}", "issue": {"value": 756439516, "label": "Datasette on Amazon Linux on ARM returns 404 for static assets"}, "performed_via_github_app": null}