Skip to content

Commit

Permalink
improve performance when processing long unicode file names
Browse files Browse the repository at this point in the history
When using a very UTF8 long file name, `secure_filename()` can slow down the FAME web server.

This performance issue is similar to CVE-2023-46695 in django. This commit resolve the issue

Thank you https://github.com/Sim4n6 for the report.
  • Loading branch information
certsocietegenerale authored Apr 29, 2024
1 parent 2e3d8bc commit 22d1d6a
Showing 1 changed file with 6 additions and 1 deletion.
7 changes: 6 additions & 1 deletion fame/common/utils.py
Original file line number Diff line number Diff line change
Expand Up @@ -122,7 +122,12 @@ def with_timeout(func, timeout, step):
return None

def sanitize_filename(filename, alternative_name):
sanitized_filename = secure_filename(str(filename))
if not filename or len(filename) > 1024:
# CVE-2023-46695: avoid using secure_filename() when the name is too long
sanitized_filename = alternative_name
else:
sanitized_filename = secure_filename(str(filename))

if not sanitized_filename or len(sanitized_filename) > 200:
sanitized_filename = alternative_name
sanitized_filename = sanitized_filename.replace('-', '_')
Expand Down

0 comments on commit 22d1d6a

Please # to comment.