From 28b9a489eee8ab1460e823e618edd16d558a931b Mon Sep 17 00:00:00 2001 From: Bryan <74067792+Bryan-Roe@users.noreply.github.com> Date: Sat, 11 Jul 2026 00:14:40 -0700 Subject: [PATCH] Potential fix for code scanning alert no. 2334: Uncontrolled data used in path expression Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- scripts/gradio_demo.py | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-) diff --git a/scripts/gradio_demo.py b/scripts/gradio_demo.py index 9deaa2ddc..c757d753f 100644 --- a/scripts/gradio_demo.py +++ b/scripts/gradio_demo.py @@ -1537,25 +1537,20 @@ def list_sessions(): def _safe_session_path(filename): if not filename or not isinstance(filename, str): return None - if os.path.isabs(filename): + # Only allow plain safe filenames with approved extensions. + if not re.fullmatch(r"[A-Za-z0-9_.-]+\.(json|md|txt)", filename): return None - # Only allow plain file names from the session list; no directory components. - if os.path.basename(filename) != filename: - return None - if not filename.endswith((".json", ".md", ".txt")): - return None - base = os.path.realpath(CONV_DIR) - candidate = os.path.realpath(os.path.join(base, filename)) + base = Path(CONV_DIR).resolve() + candidate = (base / filename).resolve() try: - if os.path.commonpath([base, candidate]) != base: - return None + candidate.relative_to(base) except ValueError: return None - return candidate + return str(candidate) def load_session(filename): path = _safe_session_path(filename) - if not path: + if not path or not os.path.isfile(path): return [], [] try: with open(path, encoding="utf-8") as f: