CVE-2024-52787

@@ -3,6 +3,7 @@
 from dataclasses import dataclass
 from typing import Any, Dict, List, Optional, Union
 
+import werkzeug
 from fastapi import APIRouter, Body, File, HTTPException, Request, UploadFile, WebSocket
 from fastapi.responses import JSONResponse
 from langchain.callbacks.base import AsyncCallbackHandler
@@ -123,7 +124,13 @@ def upload_documents(
                 )
             for uploaded in files:
                 if uploaded.filename:  # no cov
-                    file_path = os.path.join(self.conf.vector.documents_path, uploaded.filename)
+                    file_path = werkzeug.utils.safe_join(self.conf.vector.documents_path, uploaded.filename)
+                    if file_path is None:
+                        raise HTTPException(
+                            status_code=403,
+                            detail=f"Invalid file name: {uploaded.filename}",
+                        )
+
                     with open(file_path, "wb") as file:
                         file.write(uploaded.file.read())
                     # Check if the uploaded file is a zip file