From d721cbd013acf07917ddbb872cf49dff335ed863 Mon Sep 17 00:00:00 2001 From: Edward <9326037+edwardoliveira@users.noreply.github.com> Date: Mon, 12 Oct 2026 15:34:57 -0300 Subject: [PATCH] Potential fix for pull request finding 'CodeQL / Uncontrolled data used in path expression' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- sapl/materia/views.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/sapl/materia/views.py b/sapl/materia/views.py index 2c01e2eb6..99f0b4a3c 100644 --- a/sapl/materia/views.py +++ b/sapl/materia/views.py @@ -2380,7 +2380,14 @@ class DocumentoAcessorioEmLoteView(PermissionRequiredMixin, FilterView): str(doc.id)) if not os.path.exists(diretorio): os.makedirs(diretorio) - file_path = os.path.join(diretorio, arquivo.name) + safe_filename = os.path.basename(arquivo.name) + file_path = os.path.join(diretorio, safe_filename) + real_diretorio = os.path.realpath(diretorio) + real_file_path = os.path.realpath(file_path) + if os.path.commonpath([real_diretorio, real_file_path]) != real_diretorio: + msg = _('Nome de arquivo inválido.') + messages.add_message(request, messages.ERROR, msg) + return self.get(request, self.kwargs) shutil.copy2(tmp.name, file_path) doc.arquivo.name = file_path.split( MEDIA_ROOT + "/")[1] # Retira MEDIA_ROOT do nome