simulation_id, project_id, report_id, and platform parameters from API requests are used directly in os.path.join() to construct file paths. An attacker can use values like "../../etc" to read/write files or create directories outside the intended data directory. Added validation: reject any ID that differs from its os.path.basename(), which catches path separators and traversal sequences. |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| graph_builder.py | ||
| oasis_profile_generator.py | ||
| ontology_generator.py | ||
| report_agent.py | ||
| simulation_config_generator.py | ||
| simulation_ipc.py | ||
| simulation_manager.py | ||
| simulation_runner.py | ||
| text_processor.py | ||
| zep_entity_reader.py | ||
| zep_graph_memory_updater.py | ||
| zep_tools.py | ||