From 4bfd0f49e8cd3df8540dd9d51d40d0e056eeeec4 Mon Sep 17 00:00:00 2001 From: junjun Date: Mon, 1 Jun 2026 12:30:51 +0800 Subject: [PATCH] fix: Fix parseExcel vulnerability --- backend/apps/datasource/api/datasource.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/apps/datasource/api/datasource.py b/backend/apps/datasource/api/datasource.py index 01c704d0..9c8853b8 100644 --- a/backend/apps/datasource/api/datasource.py +++ b/backend/apps/datasource/api/datasource.py @@ -539,7 +539,7 @@ async def parse_excel(file: UploadFile = File(..., description=f"{PLACEHOLDER_PR raise HTTPException(400, "Only support .xlsx/.xls/.csv") os.makedirs(path, exist_ok=True) - filename = f"{file.filename.split('.')[0]}_{hashlib.sha256(uuid.uuid4().bytes).hexdigest()[:10]}.{file.filename.split('.')[-1]}" + filename = f"{file.filename.split('.')[0].split('/')[-1]}_{hashlib.sha256(uuid.uuid4().bytes).hexdigest()[:10]}.{file.filename.split('.')[-1]}" save_path = os.path.join(path, filename) with open(save_path, "wb") as f: f.write(await file.read())