Skip to content

Conversation

@praveenkk123
Copy link
Contributor

Potential fix for https://github.com/intel/AI-PC-Samples/security/code-scanning/58

The best way to fix this problem is to validate the path supplied by the user before using it with any file system operations, such as os.walk. You should define an application-level root directory (a "safe root folder") into which user-provided paths must be confined. Before proceeding with traversal, the code should:

  1. Construct a normalized, absolute path using os.path.abspath(os.path.join(BASE_ROOT, user_input)) (or similar).
  2. Use os.path.normpath to remove any .. or redundant segments.
  3. Verify that the result starts with the safe root folder path.
  4. If the input doesn't pass validation, log or display an error and avoid proceeding.

Specifically for this file:

  • Define a constant, e.g., SAFE_DATASET_ROOT at the top of the file (near other constants), pointing to a directory intended for safe storage of datasets, such as './datasets'. Ensure the directory exists (create it if not).
  • In the Streamlit input, make it clear that the folder is relative to this safe root, or disallow inputting folder paths that aren't under the safe root.
  • In get_video_paths, combine the folder argument from the user input with the safe root, normalize it, and validate it.
  • Only proceed with os.walk if validation passes, otherwise raise/log a warning or error.

You'll need to:

  • Add import for os if not present (already present).
  • Add or define SAFE_DATASET_ROOT (e.g., ./datasets) at the top.
  • In get_video_paths, implement the normalization and safety check.
  • Ensure that downstream code only ever sees safe, validated paths.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

…in path expression

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants