Fixes security issue: potential remote Path Traversal via File Upload

This commit is contained in:
2026-07-19 05:55:58 +00:00
parent 4a65c7562f
commit 39b3e633a6
10 changed files with 211 additions and 145 deletions
-18
View File
@@ -265,24 +265,6 @@ class MobileBuildRequest(Base):
completed_at = Column(DateTime, nullable=True)
class MobileBuildUploadedFile(Base):
__tablename__ = "mobile_build_uploaded_files"
id = Column(Integer, primary_key=True, autoincrement=True)
request_id = Column(Integer, ForeignKey("mobile_build_requests.id", ondelete="CASCADE"), nullable=False, index=True)
platform = Column(String(20), nullable=False)
file_kind = Column(String(40), nullable=False)
original_name = Column(String(260), nullable=False)
stored_path = Column(String(800), nullable=False)
sha256 = Column(String(64), nullable=False)
size = Column(Integer, nullable=False)
uploaded_at = Column(DateTime, nullable=False, default=datetime.utcnow)
__table_args__ = (
UniqueConstraint("request_id", "platform", "file_kind", name="uq_mobile_build_file_kind"),
)
class MobileBuildArtifact(Base):
__tablename__ = "mobile_build_artifacts"