From 9c1be9ec10b5fe919e1bdd2c38cbf556b5703ec9 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Mon, 16 Mar 2026 09:04:25 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20Fix=20potential=20command=20inje?= =?UTF-8?q?ction=20in=20rclone=20task?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds `--` separator to `rclone copy`, `mkdir`, and `link` commands in `upload_with_rclone.py`. This explicitly tells rclone to stop processing options and treat subsequent arguments strictly as positional arguments, preventing malicious user-controlled paths (starting with `-`) from being executed as arbitrary command flags. Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com> --- app/tasks/upload_with_rclone.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/app/tasks/upload_with_rclone.py b/app/tasks/upload_with_rclone.py index 769d1e52..16108617 100644 --- a/app/tasks/upload_with_rclone.py +++ b/app/tasks/upload_with_rclone.py @@ -55,12 +55,12 @@ def upload_with_rclone(self, file_path: str, destination: str): try: # Ensure the remote path exists (create folders if needed) - mkdir_cmd = ["rclone", "mkdir", "--config", rclone_config_path, destination] + mkdir_cmd = ["rclone", "mkdir", "--config", rclone_config_path, "--", destination] subprocess.run(mkdir_cmd, check=True, capture_output=True) # noqa: S603 # Construct the upload command - upload_cmd = ["rclone", "copy", "--config", rclone_config_path, file_path, destination, "--progress"] + upload_cmd = ["rclone", "copy", "--config", rclone_config_path, "--progress", "--", file_path, destination] log_task_progress(task_id, "rclone_upload", "in_progress", f"Executing rclone copy to {destination}") @@ -71,7 +71,7 @@ def upload_with_rclone(self, file_path: str, destination: str): if result.returncode == 0: # Try to get a public link if possible try: - link_cmd = ["rclone", "link", "--config", rclone_config_path, f"{destination}/{filename}"] + link_cmd = ["rclone", "link", "--config", rclone_config_path, "--", f"{destination}/{filename}"] link_result = subprocess.run(link_cmd, capture_output=True, text=True, check=False) # noqa: S603 public_url = link_result.stdout.strip() if link_result.returncode == 0 else None except (subprocess.SubprocessError, OSError) as e: