From 3073c58cab08369d1d29698882eec12d59259592 Mon Sep 17 00:00:00 2001
From: Ted Kremenek <kremenek@apple.com>
Date: Fri, 12 Oct 2012 19:16:31 +0000
Subject: [PATCH] Have scan-view guard against serving up pages outside the
 root directory.

llvm-svn: 165815
---
 clang/tools/scan-view/ScanView.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/clang/tools/scan-view/ScanView.py b/clang/tools/scan-view/ScanView.py
index c6dddba..3e03f1a 100644
--- a/clang/tools/scan-view/ScanView.py
+++ b/clang/tools/scan-view/ScanView.py
@@ -707,6 +707,11 @@ File Bug</h3>
         return None
 
     def send_path(self, path):
+        # If the requested path is outside the root directory, do not open it
+        rel = os.path.relpath(path, self.server.root)
+        if rel.startswith(os.pardir + os.sep):
+          return self.send_404()
+        
         ctype = self.guess_type(path)
         if ctype.startswith('text/'):
             # Patch file instead
-- 
2.7.4