bonna61/Moon-Household-Budget
1
0
Fork 0
Code Issues 40 Pull Requests Actions Packages Projects Releases Wiki Activity

Sanitize upload filename — path traversal in import route #3

New Issue
Open
opened 2026-06-06 19:58:10 +00:00 by tonym · 0 comments
tonym commented 2026-06-06 19:58:10 +00:00
Copy Link

Severity: critical
Category: security
Location: app.py:436

Problem

upload_path = os.path.join(DATA_DIR, file.filename) uses the raw browser filename. A name like ../transactions.json overwrites arbitrary files / clobbers the main data file.

Suggested fix

Use werkzeug.utils.secure_filename() and save into a dedicated uploads/ subdir, separate from the JSON data files.

Filed by automated code review.

**Severity:** critical **Category:** security **Location:** `app.py:436` ### Problem `upload_path = os.path.join(DATA_DIR, file.filename)` uses the raw browser filename. A name like `../transactions.json` overwrites arbitrary files / clobbers the main data file. ### Suggested fix Use `werkzeug.utils.secure_filename()` and save into a dedicated `uploads/` subdir, separate from the JSON data files. _Filed by automated code review._
tonym added the
security
severity:critical
 labels 2026-06-06 19:58:10 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
correctness
data-integrity
frontend
infra
security
severity:critical
severity:high
severity:low
severity:medium
tech-debt
No Label
security
severity:critical
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
bonna61
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: bonna61/Moon-Household-Budget#3
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?