From 361317460e8a01a2e4523be41b9a250724959f6e Mon Sep 17 00:00:00 2001 From: Chris Harris Date: Wed, 7 Oct 2026 12:28:40 +0000 Subject: [PATCH] Validate image upload path is within static directory --- backend/app/app/api/api_v1/endpoints/scans.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/backend/app/app/api/api_v1/endpoints/scans.py b/backend/app/app/api/api_v1/endpoints/scans.py index dc0d620d..dd0ec10d 100644 --- a/backend/app/app/api/api_v1/endpoints/scans.py +++ b/backend/app/app/api/api_v1/endpoints/scans.py @@ -442,8 +442,13 @@ async def upload_image( db: Session = Depends(get_db), ) -> None: format = settings.IMAGE_FORMAT + static_dir = Path(settings.IMAGE_STATIC_DIR).resolve() + upload_path = (static_dir / f"{id}.{format}").resolve() + if not upload_path.is_relative_to(static_dir): + raise HTTPException( + status_code=status.HTTP_400_BAD_REQUEST, detail="Invalid path" + ) - upload_path = Path(settings.IMAGE_STATIC_DIR) / f"{id}.{format}" async with aiofiles.open(upload_path, "wb") as fp: await upload_to_file(file, fp) @@ -453,3 +458,4 @@ async def upload_image( await send_scan_event_to_kafka( schemas.ScanUpdateEvent(image_path=image_path, id=id) ) +