From bb0e7ca050f421ee4c5050d87e31a1aa392d3d81 Mon Sep 17 00:00:00 2001 From: anupamme Date: Mon, 20 Jul 2026 20:09:57 +0000 Subject: [PATCH] fix: add path validation in profiling_utils.py User-controlled input used in file path for open() without sanitization Addresses utils.custom.path-traversal-open --- .../ColossalChat/coati/distributed/profiling_utils.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/applications/ColossalChat/coati/distributed/profiling_utils.py b/applications/ColossalChat/coati/distributed/profiling_utils.py index 1c1169b50ada..1692ab1c3bea 100644 --- a/applications/ColossalChat/coati/distributed/profiling_utils.py +++ b/applications/ColossalChat/coati/distributed/profiling_utils.py @@ -6,9 +6,12 @@ class CustomProfiler: def __init__(self, name, disabled=True): self.disabled = disabled if not disabled: - self.name = name + safe_name = os.path.basename(name) + if not safe_name or os.sep in safe_name or (os.altsep and os.altsep in safe_name): + raise ValueError(f"Invalid profiler name: {name!r}") + self.name = safe_name self.pid = os.getpid() - self.file = open(f"{name}.prof", "w") + self.file = open(os.path.join(".", self.name + ".prof"), "w") def _log(self, message): if self.disabled: