INNER CODE UNIT · Python

validate_filename

virajmavani/semi-auto-image-annotation-tool · web/backend/main.py:115

def validate_filename(filename: str) -> None:
    """Validate filename to prevent path traversal attacks"""
    if '..' in filename or filename.startswith('/') or filename.startswith('\\'):
        raise HTTPException(status_code=400, detail="Invalid filename")


def get_safe_image_path(filename: str) -> Path:
    """Get validated image path from dataset directory"""
    if current_dataset_dir is None:
        raise HTTPException(status_code=400, detail="No dataset directory set")

    validate_filename(filename)
    full_path = (current_dataset_dir / filename).resolve()

    # Ensure resolved path is still within dataset directory
    if not str(full_path).startswith(str(current_dataset_dir.resolve())):
        raise HTTPException(status_code=400, detail="Invalid path")

View source record →