Update app/tasks/upload_to_user_integration.py

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-03-21 13:18:17 +01:00
parent 0a44b06b6d
commit db88cde66e
1 changed files with 2 additions and 1 deletions
@@ -555,7 +555,8 @@ def _upload_rclone(file_path: str, cfg: dict[str, Any], creds: dict[str, Any], t
    dest = dest.replace("//", "/")

    try:
-        # SECURITY: Separate options from positional arguments using -- to prevent command injection
+        # SECURITY: Use `--` so subsequent values are treated as positional arguments, preventing
+        # option/argument injection when file paths or destinations start with '-'.
        result = subprocess.run(  # nosec B603  # noqa: S603 S607
            ["rclone", "copyto", f"--config={conf_path}", "--", file_path, dest],  # noqa: S603 S607
            capture_output=True,