Skip to content

Potential fix for code scanning alert no. 88: Uncontrolled data used in path expression #1368

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Badatos wants to merge 2 commits into
base: dev_v4
Choose a base branch
from
Draft

Potential fix for code scanning alert no. 88: Uncontrolled data used in path expression #1368

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
62c03d3
Potential fix for code scanning alert no. 88: Uncontrolled data used …
Badatos Oct 16, 2025
b6edca2
Merge branch 'dev_v4' into alert-autofix-88
Badatos Dec 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 14 additions & 1 deletion pod/video_encode_transcript/Encoding_video.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,7 +201,20 @@ def __init__(
) -> None:
"""Initialize a new Encoding_video object."""
self.id = id
self.video_file = video_file
# Secure handling of user-provided paths
base_path = getattr(settings, "MEDIA_ROOT", None)
if base_path:
norm_path = os.path.normpath(os.path.abspath(video_file))
base_path_abs = os.path.abspath(base_path)
if not norm_path.startswith(base_path_abs + os.sep):
raise ValueError(
f"Refusing video_file path outside MEDIA_ROOT. Got: {video_file}"
)
self.video_file = norm_path
else:
# Fall back to the previous assignments (should not happen in production)
self.video_file = video_file

self.duration = 0
self.list_video_track = {}
self.list_audio_track = {}
Expand Down
Loading