Validate filepaths in file utilities

[christopherholland-workday]

1. Validate that chatId and chatflowId are valid UUID's
2. Ensure that the filename does not contain path traversal patterns
3. Ensure that the sanitized filename does not contain path traversal patterns

Addresses CodeQL findings 45-50

Moved to #5842 because this PR got polluted by mistake

[gemini-code-assist]

Summary of Changes

Hello @christopherholland-workday, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the security of file utility functions by introducing robust input validation for identifiers and filenames. The changes prevent potential path traversal vulnerabilities and ensure that all file-related operations are performed with validated and sanitized inputs, thereby safeguarding the system against malicious file access attempts.

Highlights

• Input Validation: Validated that chatId and chatflowId parameters are valid UUIDs to prevent malformed inputs.
• Path Traversal Prevention: Implemented checks to ensure that filename parameters do not contain path traversal patterns, enhancing security.
• Post-Sanitization Filename Check: Added a validation step to verify that the filename remains safe and free of path traversal patterns even after sanitization.

Changelog

• packages/components/src/storageUtils.ts
  • Imported isUnsafeFilePath for new validation checks.
  • Added validation for chatId to ensure it is a valid UUID.
  • Introduced checks for fileName using isUnsafeFilePath to prevent unsafe paths.
  • Implemented post-sanitization validation for sanitizedFilename to detect any remaining path separators.
• packages/server/src/controllers/get-upload-file/index.ts
  • Imported isValidUUID and isUnsafeFilePath from flowise-components.
  • Added early validation for chatflowId and chatId to ensure they are valid UUIDs.
  • Implemented early validation for fileName using isUnsafeFilePath to catch unsafe characters at the API entry point.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request enhances security by adding validation for file path components like chatId, chatflowId, and fileName to prevent path traversal vulnerabilities. My review includes a critical fix to prevent a potential server crash from unhandled undefined inputs and a suggestion to remove a redundant check for improved code clarity and maintainability.

[gemini-code-assist]

This isPathTraversal check for chatflowId and chatId is redundant. Both variables are already validated as UUIDs in the preceding lines (line 751 for chatflowId and line 755 for chatId). A valid UUID cannot contain path traversal characters, so this check is unnecessary. Removing it will improve code clarity and remove dead code.

[christopherholland-workday]

This is more of a logical "backup" if things were moved around unknowingly later on

[HenryHengZJ]

We didnt include chatID uuid check is because in some cases, chatID can be overriden from the API call.

For example, users can override like this:

{
   question: how are you?
   chatId: sessionABC
}

[HenryHengZJ]

same as above