url/homelable
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: use re.fullmatch for media filename allowlist so CodeQL recognizes barrier

Browse Source 
ha-relevant: no
This commit is contained in:
Pouzor
2026-07-07 14:24:19 +02:00
parent 2d376c2bed
commit b907c4b05e
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/app/api/routes/media.py
+2 -2
View File
@@ -38,7 +38,7 @@ _MAGIC: dict[str, tuple[bytes, ...]] = {
MAX_BYTES = 10 * 1024 * 1024 # 10 MB MAX_BYTES = 10 * 1024 * 1024 # 10 MB
# Only ever serve/delete files we created: 32 hex chars + known extension. # Only ever serve/delete files we created: 32 hex chars + known extension.
_NAME_RE = re.compile(r"^[0-9a-f]{32}\.(png|jpg|webp)$") _NAME_RE = re.compile(r"[0-9a-f]{32}\.(png|jpg|webp)")
def _resolve_media_path(filename: str) -> Path: def _resolve_media_path(filename: str) -> Path:
@@ -48,7 +48,7 @@ def _resolve_media_path(filename: str) -> Path:
resolved path is confirmed to sit directly under the resolved media dir. resolved path is confirmed to sit directly under the resolved media dir.
Raises 404 on any mismatch so we never leak whether a path exists elsewhere. Raises 404 on any mismatch so we never leak whether a path exists elsewhere.
""" """
if not _NAME_RE.match(filename): if not _NAME_RE.fullmatch(filename):
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Not found") raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Not found")
base = settings.media_dir().resolve() base = settings.media_dir().resolve()
path = (base / filename).resolve() path = (base / filename).resolve()