Update packages/server/src/utils/createAttachment.ts

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
path traversal check on chatId
2025-11-06 14:28:14 +00:00 · 2025-11-06 11:14:05 +00:00
1 changed files with 3 additions and 3 deletions
--- a/packages/server/src/utils/createAttachment.ts
+++ b/packages/server/src/utils/createAttachment.ts
@ -27,15 +27,15 @@ export const createFileAttachment = async (req: Request) => {
    const appServer = getRunningExpressApp()

    const chatflowid = req.params.chatflowId
+    const chatId = req.params.chatId
+
    if (!chatflowid || !isValidUUID(chatflowid)) {
        throw new InternalFlowiseError(StatusCodes.BAD_REQUEST, 'Invalid chatflowId format - must be a valid UUID')
    }
-    if (isPathTraversal(chatflowid)) {
+    if (isPathTraversal(chatflowid) || (chatId && isPathTraversal(chatId))) {
        throw new InternalFlowiseError(StatusCodes.BAD_REQUEST, 'Invalid path characters detected')
    }

-    const chatId = req.params.chatId
-
    // Validate chatflow exists and check API key
    const chatflow = await appServer.AppDataSource.getRepository(ChatFlow).findOneBy({
        id: chatflowid
Author	SHA1	Message	Date
Henry Heng	0ad98a0c29	Update packages/server/src/utils/createAttachment.ts Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>	2025-11-06 14:28:14 +00:00
Henry	f4281457df	path traversal check on chatId	2025-11-06 11:14:05 +00:00