upstream-archive/textgen
1
0
Fork 0
mirror of https://github.com/oobabooga/textgen.git synced 2026-07-23 11:20:54 -05:00
Code Issues Packages Projects Releases Wiki Activity

Sanitize character name in load_character to prevent path traversal

Browse Source
This commit is contained in:
oobabooga
2026-05-20 12:23:00 -03:00
parent 619a2b8ee4
commit dc92ee774a
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
modules/chat.py
View File

@@ -2122,9 +2122,10 @@ def load_character(character, name1, name2):
greeting_field = 'greeting'
picture = None
safe_name = sanitize_filename(character)
filepath = None
for extension in ["yml", "yaml", "json"]:
filepath = shared.user_data_dir / 'characters' / f'{character}.{extension}'
filepath = shared.user_data_dir / 'characters' / f'{safe_name}.{extension}'
if filepath.exists():
break
@@ -2140,7 +2141,7 @@ def load_character(character, name1, name2):
for path in [cache_folder / "pfp_character.png", cache_folder / "pfp_character_thumb.png"]:
path.unlink(missing_ok=True)
picture = generate_pfp_cache(character)
picture = generate_pfp_cache(safe_name)
# Finding the bot's name
for k in ['name', 'bot', '<|bot|>', 'char_name']: