Skip to content

Commit

Permalink
fix path manipulation coverity issue
Browse files Browse the repository at this point in the history
  • Loading branch information
rajithkrishnegowda committed Nov 12, 2024
1 parent 3301e57 commit 21614ed
Showing 1 changed file with 2 additions and 16 deletions.
18 changes: 2 additions & 16 deletions openfl/interface/cli.py
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
"""CLI module."""
import logging
import os
import re
import pathlib
import sys
import time
import warnings
Expand Down Expand Up @@ -181,21 +181,7 @@ def cli(context, log_level, no_warnings):
# Setup logging immediately to suppress unnecessary warnings on import
# This will be overridden later with user selected debugging level
disable_warnings()
log_file = os.getenv("LOG_FILE")
# Validate log_file with tighter restrictions
if log_file:
log_file = os.path.normpath(log_file)
if (
not re.match(r"^logs/[\w\-.]+$", log_file)
or ".." in log_file
or log_file.startswith("/")
):
raise ValueError("Invalid log file path")
# Ensure the log file is in the 'logs' directory
allowed_directory = Path("logs").resolve()
full_path = (allowed_directory / log_file).resolve()
if not str(full_path).startswith(str(allowed_directory)):
raise ValueError("Log file path is not allowed")
log_file = pathlib.Path(os.getenv("LOG_FILE")).expanduser().resolve()
setup_logging(log_level, log_file)
sys.stdout.reconfigure(encoding="utf-8")

Expand Down

0 comments on commit 21614ed

Please sign in to comment.