From 6a83d51d888a20045ad2a3e4e68d3205329e3856 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 10 Mar 2026 00:01:35 +0000
Subject: [PATCH] fix(automation): address code review - path traversal fix and
 test marker

- Sanitise uploaded filenames with os.path.basename() to prevent path traversal
- Change TestWebhookDispatchIntegration marker from unit to integration

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 app/api/automation.py    | 11 ++++++++---
 tests/test_automation.py |  2 +-
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/app/api/automation.py b/app/api/automation.py
index 60935bc7..ed81a343 100644
--- a/app/api/automation.py
+++ b/app/api/automation.py
@@ -274,12 +274,17 @@ def action_upload(
     if not file.filename:
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Filename is required")
 
+    # Sanitise filename to prevent path traversal attacks
+    safe_filename = os.path.basename(file.filename)
+    if not safe_filename:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Filename is required")
+
     owner_id = user.get("preferred_username") or user.get("email") or user.get("id", "automation")
     workdir = settings.workdir or tempfile.gettempdir()
     upload_dir = os.path.join(workdir, "uploads")
     os.makedirs(upload_dir, exist_ok=True)
 
-    dest_path = os.path.join(upload_dir, file.filename)
+    dest_path = os.path.join(upload_dir, safe_filename)
     try:
         contents = file.file.read()
         with open(dest_path, "wb") as f:
@@ -295,12 +300,12 @@ def action_upload(
 
         result = process_document.delay(dest_path, owner_id)
         task_id = result.id
-        logger.info("Automation upload queued: file=%s, task=%s, owner=%s", file.filename, task_id, owner_id)
+        logger.info("Automation upload queued: file=%s, task=%s, owner=%s", safe_filename, task_id, owner_id)
     except Exception as exc:
         logger.warning("Could not queue processing task (Celery may be unavailable): %s", exc)
 
     return {
         "status": "accepted",
-        "filename": file.filename,
+        "filename": safe_filename,
         "task_id": task_id,
     }
diff --git a/tests/test_automation.py b/tests/test_automation.py
index f6882079..78d14bc3 100644
--- a/tests/test_automation.py
+++ b/tests/test_automation.py
@@ -231,7 +231,7 @@ class TestDeliverAutomationHookTask:
 # ---------------------------------------------------------------------------
 
 
-@pytest.mark.unit
+@pytest.mark.integration
 class TestWebhookDispatchIntegration:
     """Test that dispatch_webhook_event also triggers automation hooks."""