From 1934b88b0d57b9d46b4cf698eb694f2f139c5723 Mon Sep 17 00:00:00 2001 From: Jarrod Johnson Date: Wed, 1 Jul 2026 20:54:36 -0400 Subject: [PATCH] Use basename to ensure no path traversal in license filenames --- confluent_server/aiohmi/ipmi/oem/lenovo/imm.py | 1 + confluent_server/aiohmi/redfish/oem/lenovo/xcc.py | 1 + 2 files changed, 2 insertions(+) diff --git a/confluent_server/aiohmi/ipmi/oem/lenovo/imm.py b/confluent_server/aiohmi/ipmi/oem/lenovo/imm.py index 45157925..2af4c078 100644 --- a/confluent_server/aiohmi/ipmi/oem/lenovo/imm.py +++ b/confluent_server/aiohmi/ipmi/oem/lenovo/imm.py @@ -2588,6 +2588,7 @@ class XCCClient(IMMClient): rsp = await wc.grab_json_response( '/api/providers/imm_fod', {'FOD_LicenseKeyExport': licid}) filename = rsp.get('FileName', None) + filename = os.path.basename(filename) if filename else None if filename: url = '/download/' + filename savefile = os.path.join(directory, filename) diff --git a/confluent_server/aiohmi/redfish/oem/lenovo/xcc.py b/confluent_server/aiohmi/redfish/oem/lenovo/xcc.py index 1dca761f..2a83f06d 100644 --- a/confluent_server/aiohmi/redfish/oem/lenovo/xcc.py +++ b/confluent_server/aiohmi/redfish/oem/lenovo/xcc.py @@ -1693,6 +1693,7 @@ class OEMHandler(generic.OEMHandler): rsp = await wc.grab_json_response( '/api/providers/imm_fod', {'FOD_LicenseKeyExport': licid}) filename = rsp.get('FileName', None) + filename = os.path.basename(filename) if filename else None if filename: url = '/download/' + filename savefile = os.path.join(directory, filename)