Skip to content

Conversation

@praveenkk123
Copy link
Contributor

Potential fix for https://github.com/intel/AI-PC-Samples/security/code-scanning/57

To fix this issue, we should validate user-provided folder paths before using them for file system operations. The most appropriate fix is to constrain the user's input to a directory under a known root (project subdirectory), and check that the path, after normalization (using os.path.abspath or os.path.normpath), remains under that root. Concretely,

  • Define a safe root directory for all video datasets (e.g., a constant like DATASET_ROOT = "./datasets").
  • When receiving the folder name from the user, join it to the root and normalize/absolutize the resulting path.
  • Before calling os.walk, check that this normalized path starts with the root directory's absolute path.
  • If validation fails, raise an informative error or warn the user, and do not proceed.
    This prevents traversal attacks or access to arbitrary directories.

Specific changes:

  • Add a DATASET_ROOT constant, pointing to a known safe directory (e.g., ./datasets).
  • In get_video_paths, join DATASET_ROOT with the user-specified folder, normalize, and check containment.
  • Add an import for any needed utilities if not already present (only standard library).
  • Display errors via Streamlit if folder validation fails.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

…in path expression

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants