From bd0a95efac3378fe53985fc997a888cf5c142fb6 Mon Sep 17 00:00:00 2001 From: Xu Yang Date: Thu, 10 Jul 2025 13:16:14 +0800 Subject: [PATCH] fix: path traversal risk (#1050) * check the target file path is in a designed folder and make sure it's pdf * Potential fix for code scanning alert no. 55: Uncontrolled data used in path expression Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 56: Uncontrolled data used in path expression Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * continue improving * Potential fix for code scanning alert no. 62: Uncontrolled data used in path expression Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * apply secure_filename * Potential fix for code scanning alert no. 64: Uncontrolled data used in path expression Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * fix CI --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Xu Yang --- rdagent/log/server/app.py | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/rdagent/log/server/app.py b/rdagent/log/server/app.py index cca4e9fd..308175ce 100644 --- a/rdagent/log/server/app.py +++ b/rdagent/log/server/app.py @@ -10,6 +10,7 @@ import randomname import typer from flask import Flask, jsonify, request, send_from_directory from flask_cors import CORS +from werkzeug.utils import secure_filename from rdagent.log.storage import FileStorage from rdagent.log.ui.conf import UI_SETTING @@ -118,10 +119,18 @@ def upload_file(): # save files for file in files: if file: - p = log_folder_path / scenario / "uploads" / trace_name - if not p.exists(): - p.mkdir(parents=True, exist_ok=True) - file.save(p / file.filename) + p = (log_folder_path / scenario / "uploads" / trace_name).resolve() + sanitized_filename = secure_filename(file.filename) # Sanitize filename + target_path = (p / sanitized_filename).resolve() # Normalize target path + if not sanitized_filename.lower().endswith(".pdf"): + return jsonify({"error": "Invalid file type"}), 400 + # Ensure target_path is within the allowed base directory + if os.path.commonpath([str(target_path), str(p)]) == str(p) and target_path.is_file() == False: + if not p.exists(): + p.mkdir(parents=True, exist_ok=True) + file.save(target_path) + else: + return jsonify({"error": "Invalid file path"}), 400 if scenario == "Finance Data Building": cmds = ["rdagent", "fin_factor"]