From c9495d3bbcd61c531c21297dd378b00c5afa6336 Mon Sep 17 00:00:00 2001 From: Matchlighter Date: Tue, 12 Nov 2019 20:41:03 -0700 Subject: [PATCH] add support for directory traversal --- custom_components/lovelace_gen/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/custom_components/lovelace_gen/__init__.py b/custom_components/lovelace_gen/__init__.py index f4d8e22..885ea48 100644 --- a/custom_components/lovelace_gen/__init__.py +++ b/custom_components/lovelace_gen/__init__.py @@ -42,7 +42,7 @@ def _include_yaml(ldr, node): fn = node.value else: fn, args, *_ = ldr.construct_sequence(node) - fname = os.path.join(os.path.dirname(ldr.name), fn) + fname = os.path.abspath(os.path.join(os.path.dirname(ldr.name), fn)) try: return loader._add_reference(load_yaml(fname, args), ldr, node) except FileNotFoundError as exc: