issue_comments

I'm going to punt on writing a unit test for this (not sure how I'd simulate those symlinks) - I'll manually test it and push out a dot release instead.

This fix works - calling .resolve() on the root_path before the comparison to ensure symlinks are resolved: python # Ensure full_path is within root_path to avoid weird "../" tricks try: print("full_path={}, root_path={}".format(full_path, root_path)) full_path.relative_to(root_path.resolve()) except ValueError as e: print(" ValueError:", e) await asgi_send_html(send, "404", 404) return

I replaced that function with this code: ```python def asgi_static(root_path, chunk_size=4096, headers=None, content_type=None): async def inner_static(request, send): path = request.scope["url_route"]["kwargs"]["path"] print("path =", path) try: full_path = (Path(root_path) / path).resolve().absolute() except FileNotFoundError as e: print("FileNotFoundError:", e) await asgi_send_html(send, "404", 404) return if full_path.is_dir(): await asgi_send_html(send, "403: Directory listing is not allowed", 403) return # Ensure full_path is within root_path to avoid weird "../" tricks try: print("full_path={}, root_path={}".format(full_path, root_path)) full_path.relative_to(root_path) except ValueError as e: print(" ValueError:", e) await asgi_send_html(send, "404", 404) return try: await asgi_send_file(send, full_path, chunk_size=chunk_size) except FileNotFoundError: await asgi_send_html(send, "404", 404) return

return inner_static

`` Edited usingvi /home/ec2-user/.local/pipx/venvs/datasette/lib/python3.7/site-packages/datasette/utils/asgi.py`

The output shows me what the bug is: $ datasette --get /-/static/app.css --pdb app_root = /home/ec2-user/.local/pipx/venvs/datasette/lib64/python3.7/site-packages path = app.css full_path=/home/ec2-user/.local/pipx/venvs/datasette/lib/python3.7/site-packages/datasette/static/app.css, root_path=/home/ec2-user/.local/pipx/venvs/datasette/lib64/python3.7/site-packages/datasette/static ValueError: '/home/ec2-user/.local/pipx/venvs/datasette/lib/python3.7/site-packages/datasette/static/app.css' does not start with '/home/ec2-user/.local/pipx/venvs/datasette/lib64/python3.7/site-packages/datasette/static' 404 ValueError: '/home/ec2-user/.local/pipx/venvs/datasette/lib/python3.7/site-packages/datasette/static/app.css' does not start with '/home/ec2-user/.local/pipx/venvs/datasette/lib64/python3.7/site-packages/datasette/static'

One is ../lib/python3.7/.. and the other is ../lib64/python3.7/.. - there's clearly some kind of symlink in play here which I'm not taking into account.

Confirmed that installing a fresh copy of Datasette 0.52.3 on that server works correctly as expected.

https://github.com/simonw/datasette/runs/1494631261 /home/runner/work/datasette/datasette/tests/test_html.py:81: AssertionError ----------------------------- Captured stderr call ----------------------------- Traceback (most recent call last): File "/home/runner/work/datasette/datasette/datasette/app.py", line 1039, in route_path response = await view(request, send) File "/home/runner/work/datasette/datasette/datasette/utils/asgi.py", line 297, in inner_static full_path.relative_to(root_path.resolve()) AttributeError: 'str' object has no attribute 'resolve'

I tested this by running:

pipx uninstall datasette
pipx install 'https://github.com/simonw/datasette/archive/6b4c55efea3e9d34d92cbe5f0066553ad9b14071.zip'

To replace that version of Datasette (in the correct virtual environment) with this patch. It worked!

[ec2-user@ip-172-31-30-7 ~]$ datasette --get /-/static/app.css /* Reset and Page Setup ==================================================== */ ...

I'm suspicious of this code here:https://github.com/simonw/datasette/blob/e048791a9a2686f47d81a2c8aa88aa1966d82521/datasette/utils/asgi.py#L284-L307

Added a line to print out app_root from https://github.com/simonw/datasette/blob/e048791a9a2686f47d81a2c8aa88aa1966d82521/datasette/app.py#L848-L853 app_root = /home/ec2-user/.local/pipx/venvs/datasette/lib64/python3.7/site-packages

The CSS files are in the expected location: [ec2-user@ip-172-31-30-7 ~]$ find /home/ec2-user/.local/pipx/venvs/datasette | grep css /home/ec2-user/.local/pipx/venvs/datasette/lib/python3.7/site-packages/datasette/static/app.css /home/ec2-user/.local/pipx/venvs/datasette/lib/python3.7/site-packages/datasette/static/codemirror-5.57.0.min.css Wow it's running an ANCIENT version of SQLite: [ec2-user@ip-172-31-30-7 ~]$ datasette --get /-/versions.json {"python": {"version": "3.7.9", "full": "3.7.9 (default, Aug 27 2020, 21:58:41) \n[GCC 7.3.1 20180712 (Red Hat 7.3.1-9)]"}, "datasette": {"version": "0.52.2"}, "asgi": "3.0", "uvicorn": "0.12.3", "sqlite": {"version": "3.7.17", "fts_versions": ["FTS4", "FTS3"], "extensions": {}, "compile_options": ["DISABLE_DIRSYNC", "ENABLE_COLUMN_METADATA", "ENABLE_FTS3", "ENABLE_RTREE", "ENABLE_UNLOCK_NOTIFY", "SECURE_DELETE", "TEMP_STORE=1", "THREADSAFE=1"]}} http://www.sqlite.org/releaselog/3_7_17.html - SQLite Release 3.7.17 On 2013-05-20