Potential fix for code scanning alert no. 57: Uncontrolled data used in path expression #312
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Potential fix for https://github.com/intel/AI-PC-Samples/security/code-scanning/57
To fix this issue, we should validate user-provided folder paths before using them for file system operations. The most appropriate fix is to constrain the user's input to a directory under a known root (project subdirectory), and check that the path, after normalization (using
os.path.abspathoros.path.normpath), remains under that root. Concretely,DATASET_ROOT = "./datasets").os.walk, check that this normalized path starts with the root directory's absolute path.This prevents traversal attacks or access to arbitrary directories.
Specific changes:
DATASET_ROOTconstant, pointing to a known safe directory (e.g.,./datasets).get_video_paths, joinDATASET_ROOTwith the user-specifiedfolder, normalize, and check containment.Suggested fixes powered by Copilot Autofix. Review carefully before merging.