From 8b3fbdafddee7d39e86af292cf5d48f8f4ab2875 Mon Sep 17 00:00:00 2001 From: Joe Catera Date: Thu, 22 Jan 2026 19:41:30 -0800 Subject: [PATCH] Applied os.path.basename() to variable used in os.path.join that comes from an external source (like the regex matches from markdown files). --- helpers/legacy.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/helpers/legacy.py b/helpers/legacy.py index 30147dbc..a9c7885a 100644 --- a/helpers/legacy.py +++ b/helpers/legacy.py @@ -81,6 +81,11 @@ def tabulate_metrics(metrics): def copy_image(src_path, dest_path): + abs_dest = os.path.abspath(dest_path) + abs_base = os.path.abspath(OUTPUT_IMAGE_PATH) + + if not abs_dest.startswith(abs_base): + raise ValueError(f"Security Alert: Attempted path traversal to {abs_dest}") try: shutil.copyfile(src_path, dest_path) except OSError: @@ -93,7 +98,7 @@ def process_images(src_path, monitor, contents): contents = image_inline_pattern.sub(repl="![](\\1)", string=contents) for p in re.finditer(image_pattern, contents): - image_filename = p.group(1) + image_filename = os.path.basename(p.group(1)) is_integrations_github = re.match( r"https:\/\/github\.com\/signalfx\/integrations\/blob\/master\/(.*\/img\/([^\/]*))$", image_filename )