Merge pull request #935 from ethansilvas/master

Sanitize filenames file upload/delete
assafelovic · Oct 21, 2024 · 98ca10b · 98ca10b
2 parents 27976a6 + 4cda3bf
commit 98ca10b
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/backend/server/server_utils.py b/backend/server/server_utils.py
@@ -79,7 +79,7 @@ def update_environment_variables(config: Dict[str, str]):
 
 
 async def handle_file_upload(file, DOC_PATH: str) -> Dict[str, str]:
-    file_path = os.path.join(DOC_PATH, file.filename)
+    file_path = os.path.join(DOC_PATH, os.path.basename(file.filename))
     with open(file_path, "wb") as buffer:
         shutil.copyfileobj(file.file, buffer)
     print(f"File uploaded to {file_path}")
@@ -91,7 +91,7 @@ async def handle_file_upload(file, DOC_PATH: str) -> Dict[str, str]:
 
 
 async def handle_file_deletion(filename: str, DOC_PATH: str) -> JSONResponse:
-    file_path = os.path.join(DOC_PATH, filename)
+    file_path = os.path.join(DOC_PATH, os.path.basename(filename))
     if os.path.exists(file_path):
         os.remove(file_path)
         print(f"File deleted: {file_path}")