Skip to content

Commit 4bfd0f4

Browse files
committed
fix: Fix parseExcel vulnerability
1 parent 92c5aea commit 4bfd0f4

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

backend/apps/datasource/api/datasource.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -539,7 +539,7 @@ async def parse_excel(file: UploadFile = File(..., description=f"{PLACEHOLDER_PR
539539
raise HTTPException(400, "Only support .xlsx/.xls/.csv")
540540

541541
os.makedirs(path, exist_ok=True)
542-
filename = f"{file.filename.split('.')[0]}_{hashlib.sha256(uuid.uuid4().bytes).hexdigest()[:10]}.{file.filename.split('.')[-1]}"
542+
filename = f"{file.filename.split('.')[0].split('/')[-1]}_{hashlib.sha256(uuid.uuid4().bytes).hexdigest()[:10]}.{file.filename.split('.')[-1]}"
543543
save_path = os.path.join(path, filename)
544544
with open(save_path, "wb") as f:
545545
f.write(await file.read())

0 commit comments

Comments
 (0)