xCAT/confluent
2
0
Fork 0
mirror of https://github.com/xcat2/confluent.git synced 2026-08-04 00:17:01 +00:00
Code Issues Projects Releases Wiki Activity

Use basename to ensure no path traversal in license filenames

Browse Source
This commit is contained in:
Jarrod Johnson
2026-07-01 20:54:36 -04:00
parent ae290c4419
commit 1934b88b0d
2 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
confluent_server/aiohmi/ipmi/oem/lenovo/imm.py
+1
View File
@@ -2588,6 +2588,7 @@ class XCCClient(IMMClient):
rsp = await wc.grab_json_response(
'/api/providers/imm_fod', {'FOD_LicenseKeyExport': licid})
filename = rsp.get('FileName', None)
filename = os.path.basename(filename) if filename else None
if filename:
url = '/download/' + filename
savefile = os.path.join(directory, filename)
confluent_server/aiohmi/redfish/oem/lenovo/xcc.py
+1
View File
@@ -1693,6 +1693,7 @@ class OEMHandler(generic.OEMHandler):
rsp = await wc.grab_json_response(
'/api/providers/imm_fod', {'FOD_LicenseKeyExport': licid})
filename = rsp.get('FileName', None)
filename = os.path.basename(filename) if filename else None
if filename:
url = '/download/' + filename
savefile = os.path.join(directory, filename)