Web UI dataset #617
Web UI dataset #617
Conversation
# Conflicts: # cli/medperf/commands/list.py # cli/medperf/entities/benchmark.py # cli/medperf/entities/cube.py # cli/medperf/entities/dataset.py # cli/medperf/entities/interface.py
VukW
requested a deployment
to
testing-external-code
GitHub Actions
Waiting
|
MLCommons CLA bot All contributors have signed the MLCommons CLA ✍️ ✅ |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| full_path = os.path.join(BASE_DIR, path) | ||
| os.path.join(BASE_DIR, path) | ||
|
|
||
| if not os.path.exists(full_path) or not os.path.isdir(full_path): |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
There was a problem hiding this comment.
This function lists all files and folders on the server side. So, yes, it is expected to use user's given path to list its content (though still may be dangerous? I don't know)
| full_path = os.path.join(BASE_DIR, path) | ||
| os.path.join(BASE_DIR, path) | ||
|
|
||
| if not os.path.exists(full_path) or not os.path.isdir(full_path): |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
|
|
||
| # List directories inside the path | ||
| folders = [] | ||
| for item in os.listdir(full_path): |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
| folders = [] | ||
| for item in os.listdir(full_path): | ||
| item_path = os.path.join(full_path, item) | ||
| if os.path.isdir(item_path): |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
| @router.get("/fetch-yaml") | ||
| async def fetch_yaml(url: str): | ||
| try: | ||
| response = requests.get(url) |
Check failure
Code scanning / CodeQL
Full server-side request forgery Critical
VukW
requested a deployment
to
testing-external-code
GitHub Actions
Waiting
VukW
requested a deployment
to
testing-external-code
GitHub Actions
Waiting
No description provided.