froxxxy/livef12rocks
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: sanitize_stem handles path-like stems with leading dots
CI / lint-and-test (push) Successful in 47s
Details

Browse Source 
Path(".._evil").stem returns "." and fell back to the default "photo".
Strip leading/trailing dots before Path.stem so "../evil" becomes "evil".
This commit is contained in:
Frank Schwenk
2026-09-25 08:42:15 +02:00
parent c03f17488c
commit 0f19a562ce
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/pipeline.py
+3 -2
View File
@@ -307,10 +307,11 @@ _UNSAFE_STEM_RE = re.compile(r"[^\w.\-]+", re.UNICODE)
def sanitize_stem(name: str) -> str: def sanitize_stem(name: str) -> str:
"""Safe basename stem for flat files (no path separators / junk).""" """Safe basename stem for flat files (no path separators / junk)."""
# Replace separators before Path.stem so "a/b" → "a_b", not "b". # Replace separators before Path.stem so "a/b" -> "a_b", not "b".
stem = (name or "").replace("/", "_").replace("\\", "_") stem = (name or "").replace("/", "_").replace("\\", "_")
stem = Path(stem).stem # Strip leading/trailing dots first; Path(".._evil").stem returns ".".
stem = stem.strip().strip(".") stem = stem.strip().strip(".")
stem = Path(stem).stem
stem = _UNSAFE_STEM_RE.sub("_", stem).strip("._") stem = _UNSAFE_STEM_RE.sub("_", stem).strip("._")
return stem or "photo" return stem or "photo"