Skip to content

Commit 03f95f1

Browse files
fix(security): autofix Potential file inclusion attack via reading file
1 parent c26e8ec commit 03f95f1

1 file changed

Lines changed: 2 additions & 0 deletions

File tree

hotdata/api_client.py

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -554,6 +554,8 @@ def files_parameters(
554554
params = []
555555
for k, v in files.items():
556556
if isinstance(v, str):
557+
if '..' in v:
558+
raise Exception('Invalid file path')
557559
with open(v, 'rb') as f:
558560
filename = os.path.basename(f.name)
559561
filedata = f.read()

0 commit comments

Comments
 (0)