From 21614ed2c031c98371ec224ad113d5d3810c1a4b Mon Sep 17 00:00:00 2001 From: rajith Date: Tue, 12 Nov 2024 13:58:23 +0530 Subject: [PATCH] fix path manipulation coverity issue --- openfl/interface/cli.py | 18 ++---------------- 1 file changed, 2 insertions(+), 16 deletions(-) diff --git a/openfl/interface/cli.py b/openfl/interface/cli.py index ff26eddc57..9bed2d6c91 100755 --- a/openfl/interface/cli.py +++ b/openfl/interface/cli.py @@ -4,7 +4,7 @@ """CLI module.""" import logging import os -import re +import pathlib import sys import time import warnings @@ -181,21 +181,7 @@ def cli(context, log_level, no_warnings): # Setup logging immediately to suppress unnecessary warnings on import # This will be overridden later with user selected debugging level disable_warnings() - log_file = os.getenv("LOG_FILE") - # Validate log_file with tighter restrictions - if log_file: - log_file = os.path.normpath(log_file) - if ( - not re.match(r"^logs/[\w\-.]+$", log_file) - or ".." in log_file - or log_file.startswith("/") - ): - raise ValueError("Invalid log file path") - # Ensure the log file is in the 'logs' directory - allowed_directory = Path("logs").resolve() - full_path = (allowed_directory / log_file).resolve() - if not str(full_path).startswith(str(allowed_directory)): - raise ValueError("Log file path is not allowed") + log_file = pathlib.Path(os.getenv("LOG_FILE")).expanduser().resolve() setup_logging(log_level, log_file) sys.stdout.reconfigure(encoding="utf-8")