Flask implementation #39
Conversation
… don't delete all populaitons.
…th same name as neat object). + refactor main.py -> play_genome().
…n process timeout.
Co-authored-by: Håkon Støren <[email protected]> Co-authored-by: Christian Fredrik Johnsen <[email protected]>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| avg_fitnesses = [] | ||
| min_fitnesses = [] | ||
|
|
||
| if not os.path.exists(fitness_file_path): |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 2 months ago
To fix the problem, we need to validate the neat_name parameter to ensure it does not contain any malicious input that could lead to directory traversal or access to unauthorized files. We can achieve this by normalizing the path and ensuring it stays within a predefined safe directory. Additionally, we can use a whitelist of allowed directory names to further restrict the input.
- Normalize the path using
os.path.normpathto remove any ".." segments. - Ensure the normalized path starts with the base directory.
- Optionally, use a whitelist to restrict the allowed directory names.
| @@ -158,3 +158,10 @@ | ||
| """Parse fitness values from the fitness file""" | ||
| fitness_file_path = f'data/{neat_name}/fitness/fitness_values.txt' | ||
| base_path = 'data' | ||
| fitness_file_path = os.path.normpath(os.path.join(base_path, neat_name, 'fitness', 'fitness_values.txt')) | ||
|
|
||
| # Ensure the path is within the base directory | ||
| if not fitness_file_path.startswith(os.path.abspath(base_path)): | ||
| logging.error(f"Invalid path: {fitness_file_path}") | ||
| return [], [], [], [] | ||
|
|
||
| generations = [] |
| return [], [], [], [] | ||
|
|
||
| try: | ||
| with open(fitness_file_path, 'r') as f: |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 2 months ago
To fix the problem, we need to validate the neat_name parameter to ensure it does not contain any malicious input that could lead to directory traversal or unauthorized file access. We will:
- Normalize the path using
os.path.normpathto remove any ".." segments. - Ensure that the normalized path starts with the intended base directory.
- Optionally, use a whitelist of allowed directory names if the set of valid
neat_namevalues is known and limited.
| @@ -158,3 +158,4 @@ | ||
| """Parse fitness values from the fitness file""" | ||
| fitness_file_path = f'data/{neat_name}/fitness/fitness_values.txt' | ||
| base_path = 'data' | ||
| fitness_file_path = os.path.normpath(os.path.join(base_path, neat_name, 'fitness', 'fitness_values.txt')) | ||
| generations = [] | ||
| @@ -164,2 +165,6 @@ | ||
|
|
||
| if not fitness_file_path.startswith(os.path.join(base_path, neat_name)): | ||
| logging.error(f"Invalid fitness file path: {fitness_file_path}") | ||
| return [], [], [], [] | ||
|
|
||
| if not os.path.exists(fitness_file_path): |
Add web-page and change the pre-processing.