diff --git a/starlette/staticfiles.py b/starlette/staticfiles.py index 4199e510..da8a2aa3 100644 --- a/starlette/staticfiles.py +++ b/starlette/staticfiles.py @@ -23,7 +23,7 @@ class StaticFiles: if scope["method"] not in ("GET", "HEAD"): return PlainTextResponse("Method not allowed", status_code=406) path = os.path.normpath(os.path.join(*scope["path"].split("/"))) - if path.startswith('..'): + if path.startswith(".."): return PlainTextResponse("Not found", status_code=404) path = os.path.join(self.directory, path) if self.config_checked: diff --git a/tests/test_staticfiles.py b/tests/test_staticfiles.py index 7d4a2f24..ac5a6aef 100644 --- a/tests/test_staticfiles.py +++ b/tests/test_staticfiles.py @@ -125,7 +125,7 @@ def test_staticfiles_config_check_occurs_only_once(tmpdir): def test_staticfiles_prevents_breaking_out_of_directory(tmpdir): - directory = os.path.join(tmpdir, 'foo') + directory = os.path.join(tmpdir, "foo") os.mkdir(directory) path = os.path.join(tmpdir, "example.txt") @@ -134,6 +134,6 @@ def test_staticfiles_prevents_breaking_out_of_directory(tmpdir): app = StaticFiles(directory=directory) # We can't test this with 'requests', so we call the app directly here. - response = app({'method': 'GET', 'path': '/../example.txt'}) + response = app({"method": "GET", "path": "/../example.txt"}) assert response.status_code == 404 assert response.body == b"Not found"