[PR #145] [MERGED] Fix code scanning alert no. 4: Uncontrolled data used in path expression #236

New issue

Closed

opened 2026-03-02 23:34:44 +03:00 by kerem · 0 comments

kerem commented

2026-03-02 23:34:44 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/AJaySi/ALwrity/pull/145
Author: @AJaySi
Created: 1/9/2025
Status: ✅ Merged
Merged: 1/13/2025
Merged by: @AJaySi

Base: main ← Head: alert-autofix-4

📝 Commits (1)

f97a223 Fix code scanning alert no. 4: Uncontrolled data used in path expression

📊 Changes

1 file changed (+10 additions, -2 deletions)

View changed files

📝 lib/ai_seo_tools/image_alt_text_generator.py (+10 -2)

📄 Description

Fixes https://github.com/AJaySi/AI-Writer/security/code-scanning/4

To fix the problem, we need to ensure that the image_path provided by the user is validated and sanitized before being used in file operations. We can achieve this by normalizing the path and ensuring it is within a specific directory. This will prevent path traversal attacks and restrict file access to a safe directory.

Define a safe root directory where image files are expected to be located.
Normalize the user-provided path using os.path.normpath.
Check if the normalized path starts with the safe root directory.
If the path is valid, proceed with the file operations; otherwise, raise an error.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/AJaySi/ALwrity/pull/145 **Author:** [@AJaySi](https://github.com/AJaySi) **Created:** 1/9/2025 **Status:** ✅ Merged **Merged:** 1/13/2025 **Merged by:** [@AJaySi](https://github.com/AJaySi) **Base:** `main` ← **Head:** `alert-autofix-4` --- ### 📝 Commits (1) - [`f97a223`](https://github.com/AJaySi/ALwrity/commit/f97a223d7cf2fe8146f8d0bd4db76ae29f8dd8e8) Fix code scanning alert no. 4: Uncontrolled data used in path expression ### 📊 Changes **1 file changed** (+10 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `lib/ai_seo_tools/image_alt_text_generator.py` (+10 -2) </details> ### 📄 Description Fixes [https://github.com/AJaySi/AI-Writer/security/code-scanning/4](https://github.com/AJaySi/AI-Writer/security/code-scanning/4) To fix the problem, we need to ensure that the `image_path` provided by the user is validated and sanitized before being used in file operations. We can achieve this by normalizing the path and ensuring it is within a specific directory. This will prevent path traversal attacks and restrict file access to a safe directory. 1. Define a safe root directory where image files are expected to be located. 2. Normalize the user-provided path using `os.path.normpath`. 3. Check if the normalized path starts with the safe root directory. 4. If the path is valid, proceed with the file operations; otherwise, raise an error. _Suggested fixes powered by Copilot Autofix. Review carefully before merging._ --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>