Emil_Shanaty/open-webui-ai4me
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refac

Browse Source
This commit is contained in:
Timothy Jaeryang Baek
2026-03-01 13:28:32 -06:00
parent 0fff2fbcab
commit 62ab30f593
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/open_webui/routers/audio.py
+7 -1
View File
@@ -1194,7 +1194,9 @@ def transcription(
) )
try: try:
ext = file.filename.split(".")[-1] ext = file.filename.split(".")[-1] if file.filename else ""
ext = ext.replace("/", "").replace("\\", "").replace("..", "")
id = uuid.uuid4() id = uuid.uuid4()
filename = f"{id}.{ext}" filename = f"{id}.{ext}"
@@ -1204,6 +1206,10 @@ def transcription(
os.makedirs(file_dir, exist_ok=True) os.makedirs(file_dir, exist_ok=True)
file_path = f"{file_dir}/{filename}" file_path = f"{file_dir}/{filename}"
# Defense-in-depth: ensure resolved path stays within intended directory
if not os.path.realpath(file_path).startswith(os.path.realpath(file_dir)):
raise ValueError("Invalid file path detected")
with open(file_path, "wb") as f: with open(file_path, "wb") as f:
f.write(contents) f.write(contents)