xinyin025/LangBot
1
0
Fork 0
mirror of https://github.com/langbot-app/LangBot.git synced 2026-06-02 03:55:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: CVE-2025-59835 (#1691)

Browse Source
This commit is contained in:
Junyan Qin (Chin)
2025-09-26 13:22:19 +08:00
committed by GitHub
parent ca3d3b2a66
commit 1191b34fd4
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
pkg/api/http/controller/groups/files.py
View File

@@ -15,6 +15,9 @@ class FilesRouterGroup(group.RouterGroup):
async def initialize(self) -> None:
@self.route('/image/<image_key>', methods=['GET'], auth_type=group.AuthType.NONE)
async def _(image_key: str) -> quart.Response:
if '/' in image_key or '\\' in image_key:
return quart.Response(status=404)
if not await self.ap.storage_mgr.storage_provider.exists(image_key):
return quart.Response(status=404)
@@ -36,6 +39,10 @@ class FilesRouterGroup(group.RouterGroup):
extension = file.filename.split('.')[-1]
file_name = file.filename.split('.')[0]
# check if file name contains '/' or '\'
if '/' in file_name or '\\' in file_name:
return self.fail(400, 'File name contains invalid characters')
file_key = file_name + '_' + str(uuid.uuid4())[:8] + '.' + extension
# save file to storage
await self.ap.storage_mgr.storage_provider.save(file_key, file_bytes)