From 5e911ed268e8773fe00acc94d370320fdc56d77f Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Mon, 16 Mar 2026 08:57:57 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20fix(tasks):=20prevent=20command?= =?UTF-8?q?=20injection=20in=20rclone=20commands?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Added the `--` argument before positional arguments in rclone subprocess calls (link, mkdir, copy) in `app/tasks/upload_with_rclone.py`. This ensures that filenames or destinations starting with a hyphen are treated as paths rather than unintended command-line flags. Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com> --- app/tasks/upload_with_rclone.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/app/tasks/upload_with_rclone.py b/app/tasks/upload_with_rclone.py index 769d1e52..16108617 100644 --- a/app/tasks/upload_with_rclone.py +++ b/app/tasks/upload_with_rclone.py @@ -55,12 +55,12 @@ def upload_with_rclone(self, file_path: str, destination: str): try: # Ensure the remote path exists (create folders if needed) - mkdir_cmd = ["rclone", "mkdir", "--config", rclone_config_path, destination] + mkdir_cmd = ["rclone", "mkdir", "--config", rclone_config_path, "--", destination] subprocess.run(mkdir_cmd, check=True, capture_output=True) # noqa: S603 # Construct the upload command - upload_cmd = ["rclone", "copy", "--config", rclone_config_path, file_path, destination, "--progress"] + upload_cmd = ["rclone", "copy", "--config", rclone_config_path, "--progress", "--", file_path, destination] log_task_progress(task_id, "rclone_upload", "in_progress", f"Executing rclone copy to {destination}") @@ -71,7 +71,7 @@ def upload_with_rclone(self, file_path: str, destination: str): if result.returncode == 0: # Try to get a public link if possible try: - link_cmd = ["rclone", "link", "--config", rclone_config_path, f"{destination}/{filename}"] + link_cmd = ["rclone", "link", "--config", rclone_config_path, "--", f"{destination}/{filename}"] link_result = subprocess.run(link_cmd, capture_output=True, text=True, check=False) # noqa: S603 public_url = link_result.stdout.strip() if link_result.returncode == 0 else None except (subprocess.SubprocessError, OSError) as e: