gpt4free

公开

关注 0 Fork 0 Star 1

XFEstudio/gpt4free

fix(security): sanitize file names and prevent path traversal in media handlers

47cf046b

Anand Mall <anand@example.com>

提交于 2026-09-07 11:26

父提交 b4768cc

1 个文件 +9 -4

Modified g4f/gui/server/backend_api.py +9 -4

@@ -994,15 +994,20 @@ class Backend_Api(Api):

994 994 file = None

995 995 if "file" in request.files:

996 996 file = request.files["file"]

997 if file.filename == "":

997 if not file.filename:

998 998 return "No selected file", 400

999 999 if (

1000 1000 file

1001 and file.filename.endswith(".json")

1002 or file.filename.endswith(".har")

1001 and (file.filename.endswith(".json") or file.filename.endswith(".har"))

1003 1002 ):

1004 1003 filename = secure_filename(file.filename)

1005 file.save(os.path.join(get_cookies_dir(), filename))

1004 if not filename:

1005 return "Not supported file", 400

1006 cookies_dir = os.path.abspath(get_cookies_dir())

1007 target_path = os.path.abspath(os.path.join(cookies_dir, filename))

1008 if not target_path.startswith(cookies_dir):

1009 return "Forbidden file path", 403

1010 file.save(target_path)

1006 1011 return "File saved", 200

1007 1012 return "Not supported file", 400

1008 1013