From 29bd7b9d6713ce7ed92d7dd0bf45f30f26d25439 Mon Sep 17 00:00:00 2001 From: Edward <9326037+edwardoliveira@users.noreply.github.com> Date: Mon, 12 Oct 2026 15:34:13 -0300 Subject: [PATCH] Potential fix for pull request finding 'CodeQL / Uncontrolled data used in path expression' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- sapl/base/media.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/sapl/base/media.py b/sapl/base/media.py index 639334a33..0b7435116 100644 --- a/sapl/base/media.py +++ b/sapl/base/media.py @@ -95,10 +95,14 @@ def media(request, path): if settings.DEBUG: try: + media_root = os.path.realpath(settings.MEDIA_ROOT) + caminho = os.path.realpath(os.path.join(media_root, nome)) + if os.path.commonpath([media_root, caminho]) != media_root: + raise Http404 response = FileResponse( - open(os.path.join(settings.MEDIA_ROOT, nome), 'rb'), + open(caminho, 'rb'), content_type=content_type) - except (FileNotFoundError, IsADirectoryError): + except (FileNotFoundError, IsADirectoryError, ValueError): raise Http404 else: response = HttpResponse(content_type=content_type)