diff --git a/lollms/security.py b/lollms/security.py index 597bc19..5917c57 100644 --- a/lollms/security.py +++ b/lollms/security.py @@ -123,14 +123,15 @@ def sanitize_path(path: str, allow_absolute_path: bool = False, error_text="Abso ----- This function checks for patterns like "....", multiple forward slashes, and command injection attempts like $(whoami). It also checks for unauthorized punctuation characters, excluding the dot (.) character. """ + if path is None: + return path + if not allow_absolute_path and path.strip().startswith("/"): raise HTTPException(status_code=400, detail=exception_text) # Normalize path to use forward slashes path = path.replace('\\', '/') - if path is None: - return path # Regular expression to detect patterns like "....", multiple forward slashes, and command injection attempts like $(whoami) suspicious_patterns = re.compile(r'(\.\.+)|(/+/)|(\$\(.*\))') @@ -237,4 +238,4 @@ if __name__=="__main__": sanitize_path_from_endpoint("cat/main") print("Main passed") sanitize_path_from_endpoint(".../user") - print("hi") \ No newline at end of file + print("hi")