9815db9811
This prevents a development-mode-only directory traversal attack, where the Django development server could be made to respond to requests for `/user_avatars/../../../../../../etc/passwd`. The production server is not affected by this vulnerability, as nginx's configuration sets `PATH_INFO` to `$document_uri`, which is normalized[^1] -- that is, by the time uwsgi and Django see it, the path has been percent-decoded once, and all `../` path components have been applied[^2]. Close this by explicitly normalizing the paths before comparing; the `LOCAL_UPLOADS_DIR` side is unlikely to require normalization as well, but is also normalized for consistency. The failure here is left as an assertion failure, and not a JsonableError, because it only affects the development server. [^1]: https://nginx.org/en/docs/http/ngx_http_core_module.html#var_uri [^2]: https://nginx.org/en/docs/http/ngx_http_core_module.html#location
Zulip overview
Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and delightful. Fortune 500 companies, leading open source projects, and thousands of other organizations use Zulip every day. Zulip is the only modern team chat app that is designed for both live and asynchronous conversations.
Zulip is built by a distributed community of developers from all around the world, with 97+ people who have each contributed 100+ commits. With over 1,500 contributors merging over 500 commits a month, Zulip is the largest and fastest growing open source team chat project.
Come find us on the development community chat!
Getting started
-
Contributing code. Check out our guide for new contributors to get started. We have invested in making Zulip’s code highly readable, thoughtfully tested, and easy to modify. Beyond that, we have written an extraordinary 185K words of documentation for Zulip contributors.
-
Contributing non-code. Report an issue, translate Zulip into your language, or give us feedback. We'd love to hear from you, whether you've been using Zulip for years, or are just trying it out for the first time.
-
Checking Zulip out. The best way to see Zulip in action is to drop by the Zulip community server. We also recommend reading about Zulip's unique approach to organizing conversations.
-
Running a Zulip server. Self-host Zulip directly on Ubuntu or Debian Linux, in Docker, or with prebuilt images for Digital Ocean and Render. Learn more about self-hosting Zulip.
-
Using Zulip without setting up a server. Learn about Zulip Cloud hosting options. Zulip sponsors free Zulip Cloud Standard for hundreds of worthy organizations, including fellow open-source projects.
-
Participating in outreach programs like Google Summer of Code and Outreachy.
-
Supporting Zulip. Advocate for your organization to use Zulip, become a sponsor, write a review in the mobile app stores, or help others find Zulip.
You may also be interested in reading our blog, and following us on Twitter and LinkedIn.
Zulip is distributed under the Apache 2.0 license.