ChatDev

mirror of https://github.com/OpenBMB/ChatDev.git synced 2026-07-26 16:07:55 +00:00

History

swaylq 0014dbba7c fix: sanitize upload filename to prevent path traversal (#638 )

`AttachmentService.save_upload_file` joined the client-supplied multipart
filename onto a fresh temp directory without sanitization. A filename with
`../` segments escaped the temp dir, so the upload wrote attacker-controlled
bytes to an arbitrary host path and the `finally` cleanup `unlink` then
deleted that same traversed path — arbitrary file write and delete behind an
endpoint that only requires an unauthenticated session id.

Reduce the filename to its basename (normalising POSIX and Windows
separators, falling back to `upload.bin` for empty/`.`/`..`) before building
the temp path, so writes stay confined to the temp directory.

Adds regression tests: a parametrized check of the basename normalisation and
an end-to-end test proving a traversal filename can no longer overwrite or
delete a victim file outside the temp/WareHouse area.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-16 13:22:34 +08:00

__init__.py

initial commit of chatdev 2.0

2026-01-07 16:24:01 +08:00

artifact_dispatcher.py

initial commit of chatdev 2.0

2026-01-07 16:24:01 +08:00

artifact_events.py

initial commit of chatdev 2.0

2026-01-07 16:24:01 +08:00

attachment_service.py

fix: sanitize upload filename to prevent path traversal (#638 )