github/AutoGPT
1
1
Fork 0
mirror of https://github.com/Significant-Gravitas/AutoGPT.git synced 2026-02-11 07:15:08 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix(backend/chat): Sanitize session_id in SDK cwd path to prevent path traversal

Browse Source
This commit is contained in:
Zamil Majdy
2026-02-11 06:26:48 +04:00
parent 44f9536bd6
commit e85d437bb2
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
autogpt_platform/backend/backend/api/features/chat/sdk/service.py
View File

@@ -238,8 +238,9 @@ async def stream_chat_completion_sdk(
stream_completed = False
# Use a session-specific temp dir to avoid cleanup race conditions
# between concurrent sessions.
sdk_cwd = f"/tmp/copilot-{session_id}"
# between concurrent sessions. Sanitize session_id to prevent path traversal.
safe_session_id = "".join(c for c in session_id if c.isalnum() or c == "-")
sdk_cwd = f"/tmp/copilot-{safe_session_id}"
os.makedirs(sdk_cwd, exist_ok=True)
try: