Skip to content

Commit e3778b7

Browse files
fix: prevent path traversal in bibtex-compatibility.py
This commit addresses a security vulnerability where unvalidated command line input could lead to potential path traversal. The script now: - Checks if the required command-line argument is provided. - Uses `os.path.basename()` to sanitize the input database name, ensuring that it cannot be used to access files outside the current directory. - Gracefully exits with a usage message if arguments are missing. Co-authored-by: k4rtik <374340+k4rtik@users.noreply.github.com>
1 parent c082ae6 commit e3778b7

File tree

1 file changed

+6
-1
lines changed

1 file changed

+6
-1
lines changed

bibtex-compatibility.py

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
# Original source: https://github.com/jonsterling/bibtex-references
33
# Modified by Kartik for use in qpl-bib
44

5+
import os
56
import re
67
import sys
78

@@ -20,7 +21,11 @@
2021
12: "dec"
2122
}
2223

23-
db_name = sys.argv[1]
24+
if len(sys.argv) < 2:
25+
print("Usage: python3 bibtex-compatibility.py <db_name>")
26+
sys.exit(1)
27+
28+
db_name = os.path.basename(sys.argv[1])
2429

2530
old_db = open(db_name + ".bib","r")
2631
new_db = open("bibtex.bib","w")

0 commit comments

Comments
 (0)