kunthawat/ALwrity
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Potential fix for code scanning alert no. 121: Uncontrolled data used in path expression

Browse Source 
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
This commit is contained in:
ي
2026-05-25 17:34:29 +05:30
committed by GitHub
parent cb3666dd7b
commit a4e2122382
1 changed files with 6 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
backend/routers/video_studio/endpoints/serve.py
View File

@@ -40,29 +40,25 @@ async def serve_video_studio_video(
video_studio_videos_dir = base_dir / "video_studio_videos" video_studio_videos_dir = base_dir / "video_studio_videos"
video_path = video_studio_videos_dir / user_id / video_filename video_path = video_studio_videos_dir / user_id / video_filename
# Security: Ensure path is within video_studio_videos directory # Security: Resolve and ensure path is within video_studio_videos directory
try: try:
resolved_path = video_path.resolve()
resolved_base = video_studio_videos_dir.resolve() resolved_base = video_studio_videos_dir.resolve()
if not str(resolved_path).startswith(str(resolved_base)): resolved_path = video_path.resolve()
raise HTTPException( resolved_path.relative_to(resolved_base)
status_code=403,
detail="Invalid video path"
)
except (OSError, ValueError) as e: except (OSError, ValueError) as e:
logger.error(f"[VideoStudio] Path resolution error: {e}") logger.error(f"[VideoStudio] Path resolution error: {e}")
raise HTTPException(status_code=403, detail="Invalid video path") raise HTTPException(status_code=403, detail="Invalid video path")
# Check if file exists # Check if file exists
if not video_path.exists() or not video_path.is_file(): if not resolved_path.exists() or not resolved_path.is_file():
raise HTTPException( raise HTTPException(
status_code=404, status_code=404,
detail=f"Video not found: {video_filename}" detail=f"Video not found: {video_filename}"
) )
logger.info(f"[VideoStudio] Serving video: {video_path}") logger.info(f"[VideoStudio] Serving video: {resolved_path}")
return FileResponse( return FileResponse(
path=str(video_path), path=str(resolved_path),
media_type="video/mp4", media_type="video/mp4",
filename=video_filename, filename=video_filename,
) )