SMEISEN/RidingCoachApp

Fix code scanning alert - Uncontrolled data used in path expression

Closed this issue · 3 comments

SMEISEN commented

Tracking issue for:

  • https://github.com/SMEISEN/RidingCoachApp/security/code-scanning/2

  • Do not allow more than a single “.” character.

  • Do not allow directory separators such as “/” or “\” (depending on the file system).

  • Do not rely on simply replacing problematic sequences such as “../”. For example, after applying this filter to “…/…//”, the resulting string would still be “../”.

  • Use an allowlist of known good patterns.

SMEISEN commented

remove all dots and directory delimiters from the filename before using

SMEISEN commented 
test = "../test/../test\\.../...//test.csv"

# remove slashes and backslashes
test = test.replace("/", "").replace("\\", "")

# remove multiple dots
dots = test.count(".")
dots = [f"{i*'.'}" for i in range(2,dots)]
for dot in dots:
    test = test.replace(dot, "")