Path Traversal Double Encoding Bypass

1from flask import Flask, request, send_file
2from urllib.parse import unquote
3import os
4
5app = Flask(__name__)
6
7@app.route('/download')
8def download():
9    filename = request.args.get('file', '')
10    
11    # Decode URL encoding
12    filename = unquote(filename)
13    
14    # Check for path traversal
15    if '..' in filename:
16        return "Invalid path", 400
17    
18    filepath = os.path.join('/var/uploads', filename)
19    return send_file(filepath)