upload #112

New issue

Closed

opened 2026-10-18 21:10:55 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-18 21:10:55 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-terminal/pull/26
Author: @shuofengzhang
Created: 3/7/2026
Status: ❌ Closed

Base: main ← Head: fix-upload-path-safety

📝 Commits (1)

bbd36f9 Harden file upload path handling

📊 Changes

1 file changed (+7 additions, -2 deletions)

View changed files

📝 open_terminal/main.py (+7 -2)

📄 Description

What changed

Sanitized uploaded filenames with os.path.basename(...) for both URL and multipart uploads.
Normalized upload destination to an absolute directory path before writing.
Added a commonpath guard to ensure the final write path stays inside the requested upload directory.

Why

UploadFile.filename can contain path segments from clients. Joining it directly can allow writes outside the intended destination.
Normalizing and validating the resolved path makes /files/upload behavior consistent with other file endpoints and avoids accidental path traversal.

Testing

source .venv/bin/activate && pytest -q
Tests: not run (no tests found)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-terminal/pull/26 **Author:** [@shuofengzhang](https://github.com/shuofengzhang) **Created:** 3/7/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix-upload-path-safety` --- ### 📝 Commits (1) - [`bbd36f9`](https://github.com/open-webui/open-terminal/commit/bbd36f96dad94e43ef1c2bf2f69d8bc83787794d) Harden file upload path handling ### 📊 Changes **1 file changed** (+7 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `open_terminal/main.py` (+7 -2) </details> ### 📄 Description ## What changed - Sanitized uploaded filenames with `os.path.basename(...)` for both URL and multipart uploads. - Normalized upload destination to an absolute directory path before writing. - Added a `commonpath` guard to ensure the final write path stays inside the requested upload directory. ## Why - `UploadFile.filename` can contain path segments from clients. Joining it directly can allow writes outside the intended destination. - Normalizing and validating the resolved path makes `/files/upload` behavior consistent with other file endpoints and avoids accidental path traversal. ## Testing - `source .venv/bin/activate && pytest -q` - Tests: not run (no tests found) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-18 21:10:55 +00:00

closed this issue
added the
pull-request
label

No labels

bug

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

open-webui/open-terminal#112

No description provided.

Rows
Columns