klinsmaya/SQLBot
1
0
Fork 0
mirror of https://gh-proxy.org/https://github.com/klinsmaya/SQLBot.git synced 2026-11-08 01:06:59 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: prevent path traversal in Excel upload (CWE-22)

Browse Source
This commit is contained in:
ulleo
2026-08-28 17:51:27 +08:00
committed by ulleo
parent 49a50e3bce
commit 66a1b33ac4
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/apps/data_training/api/data_training.py
+10 -4
View File
@@ -171,9 +171,13 @@ async def upload_excel(trans: Trans, current_user: CurrentUser, file: UploadFile
raise HTTPException(400, "Only support .xlsx/.xls")
os.makedirs(path, exist_ok=True)
base_filename = f"{file.filename.split('.')[0]}_{hashlib.sha256(uuid.uuid4().bytes).hexdigest()[:10]}"
filename = f"{base_filename}.{file.filename.split('.')[1]}"
save_path = os.path.join(path, filename)
safe_name = os.path.basename(file.filename)
name_root, name_ext = os.path.splitext(safe_name)
base_filename = f"{name_root}_{hashlib.sha256(uuid.uuid4().bytes).hexdigest()[:10]}"
filename = f"{base_filename}{name_ext}"
save_path = os.path.realpath(os.path.join(path, filename))
if os.path.commonpath([save_path, os.path.realpath(path)]) != os.path.realpath(path):
raise HTTPException(400, "Invalid filename")
with open(save_path, "wb") as f:
f.write(await file.read())
@@ -251,7 +255,9 @@ async def upload_excel(trans: Trans, current_user: CurrentUser, file: UploadFile
df = pd.DataFrame(md_data, columns=_fields_list)
error_excel_filename = f"{base_filename}_error.xlsx"
save_error_path = os.path.join(path, error_excel_filename)
save_error_path = os.path.realpath(os.path.join(path, error_excel_filename))
if os.path.commonpath([save_error_path, os.path.realpath(path)]) != os.path.realpath(path):
raise Exception("Invalid filename")
# 保存 DataFrame 到 Excel
df.to_excel(save_error_path, index=False)