Help improve my file upload method (Pyramid framework)

Question

Currently, I am using the following method for uploading files (via HTML form) in Pyramid.

if request.params.get('form.submitted'):

    upload_directory = os.getcwd() + '/myapp/static/uploads/'

    my_file = request.POST.get('thumbnail')
    saved_file = str(upload_directory) + str(my_file.filename)

    perm_file = open(saved_file, 'w')

    shutil.copyfileobj(my_file.file, perm_file)
    my_file.file.close()
    perm_file.close()

I am just wondering, is this a good way of saving file uploads, are there any security concerns with my method? How else can I improve my method. Thanks.

Answer 1

You'll want to use something like werkzug's safe_join rather than just adding the upload directory to the given file name. An attacker could create a POST with a filename of ../../../some/important/path and cause this script to overwrite some file outside of your upload_directory.