From aad5ee81145d7bbf25e29cf1e56e2a4444baf64b Mon Sep 17 00:00:00 2001 From: Qing Date: Sat, 23 Nov 2024 15:05:39 +0800 Subject: [PATCH] fix https://github.com/Sanster/IOPaint/issues/597 bug is intruduced in https://github.com/Sanster/IOPaint/pull/586 --- iopaint/api.py | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/iopaint/api.py b/iopaint/api.py index b144a3c..1c4a73f 100644 --- a/iopaint/api.py +++ b/iopaint/api.py @@ -183,12 +183,22 @@ class Api: return self.app.add_api_route(path, endpoint, **kwargs) def api_save_image(self, file: UploadFile): - file_to_write = Path(file.filename) - if not file_to_write.is_file(): - return + # Sanitize filename to prevent path traversal + safe_filename = Path(file.filename).name # Get just the filename component + # Construct the full path within output_dir + output_path = self.config.output_dir / safe_filename + + # Ensure output directory exists + if not self.config.output_dir or not self.config.output_dir.exists(): + raise HTTPException( + status_code=400, + detail="Output directory not configured or doesn't exist", + ) + + # Read and write the file origin_image_bytes = file.file.read() - with open(self.config.output_dir / file_to_write.name, "wb") as fw: + with open(output_path, "wb") as fw: fw.write(origin_image_bytes) def api_current_model(self) -> ModelInfo: