From db88cde66e2e834bb5c6c275dde5f04872160eeb Mon Sep 17 00:00:00 2001 From: Christian Krakau-Louis Date: Sat, 21 Mar 2026 13:18:17 +0100 Subject: [PATCH] Update app/tasks/upload_to_user_integration.py Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- app/tasks/upload_to_user_integration.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/app/tasks/upload_to_user_integration.py b/app/tasks/upload_to_user_integration.py index 9654fb5c..24754200 100644 --- a/app/tasks/upload_to_user_integration.py +++ b/app/tasks/upload_to_user_integration.py @@ -555,7 +555,8 @@ def _upload_rclone(file_path: str, cfg: dict[str, Any], creds: dict[str, Any], t dest = dest.replace("//", "/") try: - # SECURITY: Separate options from positional arguments using -- to prevent command injection + # SECURITY: Use `--` so subsequent values are treated as positional arguments, preventing + # option/argument injection when file paths or destinations start with '-'. result = subprocess.run( # nosec B603 # noqa: S603 S607 ["rclone", "copyto", f"--config={conf_path}", "--", file_path, dest], # noqa: S603 S607 capture_output=True,