WooYun.org

#!/usr/bin/python
import tornado.ioloop
import tornado.web
class MainHandler(tornado.web.RequestHandler):
	def get(self):
		self.write("Hello, world")
if __name__ == "__main__":
	setting = {
		"debug": True,
		"static_path": "/Users/phithon/pro/python/wooyun/tornado-file-read/static/",
	}
	application = tornado.web.Application([
		(r"/", MainHandler),
	], **setting)
	application.listen(8888)
	tornado.ioloop.IOLoop.instance().start()

def validate_absolute_path(self, root, absolute_path):
        """Validate and return the absolute path.
        ``root`` is the configured path for the `StaticFileHandler`,
        and ``path`` is the result of `get_absolute_path`
        This is an instance method called during request processing,
        so it may raise `HTTPError` or use methods like
        `RequestHandler.redirect` (return None after redirecting to
        halt further processing).  This is where 404 errors for missing files
        are generated.
        This method may modify the path before returning it, but note that
        any such modifications will not be understood by `make_static_url`.
        In instance methods, this method's result is available as
        ``self.absolute_path``.
        .. versionadded:: 3.1
        """
        root = os.path.abspath(root)
        # os.path.abspath strips a trailing /
        # it needs to be temporarily added back for requests to root/
        if not (absolute_path + os.path.sep).startswith(root):
            raise HTTPError(403, "%s is not in root static directory",
                            self.path)
        if (os.path.isdir(absolute_path) and
                self.default_filename is not None):
            # need to look at the request.path here for when path is empty
            # but there is some prefix to the path that was already
            # trimmed by the routing
            if not self.request.path.endswith("/"):
                self.redirect(self.request.path + "/", permanent=True)
                return
            absolute_path = os.path.join(absolute_path, self.default_filename)
        if not os.path.exists(absolute_path):
            raise HTTPError(404)
        if not os.path.isfile(absolute_path):
            raise HTTPError(403, "%s is not a file", self.path)
        return absolute_path