From 915b985b232b2f8001b0cda470c26d5c6ce41ad6 Mon Sep 17 00:00:00 2001 From: anupamme Date: Tue, 21 Jul 2026 18:45:20 +0000 Subject: [PATCH] fix: sanitize subprocess call in app.py The application uses subprocess --- WAVE2SCORE/app.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/WAVE2SCORE/app.py b/WAVE2SCORE/app.py index b3ba57c360..38f7dbe742 100644 --- a/WAVE2SCORE/app.py +++ b/WAVE2SCORE/app.py @@ -55,9 +55,12 @@ def run_job(job_id: str): return job_dir = Path(job["job_dir"]) - input_path = Path(job["input_path"]) + input_path = Path(job["input_path"]).resolve() out_base = str(job_dir / "result") + if not str(input_path).startswith(str(WORK_DIR.resolve())): + raise RuntimeError("Invalid input path: outside of work directory") + try: set_job(job_id, status="running", message="Running main.py")