Fix/security alerts 0818

.github/workflows/autopep8.yml

@@ -33,7 +33,7 @@ jobs:
         run: python --version
 
       - name: Install packages
-        run: pip install autopep8
+        run: pip install "autopep8==2.3.2" --hash=sha256:ce8ad498672c845a0c3de2629c15b635ec205ef8177a6e7c91c74f3e9b51128 --hash=sha256:894404f969197b69a995e4ce0661b031f455a9f776d2c5ba3dbd83466931758
 
       - name: Check code formatting style
         run: |

LLM/src/st_rag_chat.py

@@ -88,6 +88,13 @@ def load_document(source_path, source_type="URL"):
         return loader.load()
     else:
         # Load from local file in data folder
+        if not source_path:
+            raise ValueError("A local filename must be provided.")
+        # Reject absolute paths and any path separators before joining
+        if os.path.isabs(source_path) or os.path.basename(source_path) != source_path:
+            raise ValueError("Only filenames from the data directory are allowed.")
+        if not source_path.lower().endswith((".txt", ".pdf", ".md")):
+            raise ValueError("Only .txt, .pdf, and .md files are supported.")
         current_dir = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))  # Go up to LLM folder
         data_dir = os.path.abspath(os.path.join(current_dir, "data"))
         full_path = os.path.abspath(os.path.normpath(os.path.join(data_dir, source_path)))

Video-Description-Generation-Query-Retrieval/st_video_rag_demo.py

@@ -308,9 +308,9 @@ def get_video_paths(folder, max_count):
         video_files = []
 
         requested_folder = folder.strip() if folder else "."
-        # Reject absolute paths; resolve symlinks to prevent traversal
-        if os.path.isabs(requested_folder):
-            logging.error("Absolute paths are not allowed for video folder input.")
+        # Reject absolute paths and any path separators before joining
+        if os.path.isabs(requested_folder) or os.path.basename(requested_folder) != requested_folder:
+            logging.error("Invalid video folder: only simple directory names are allowed.")
             return []
         root_real = os.path.realpath(VIDEO_DATASET_ROOT)
         folder_path = os.path.realpath(os.path.join(VIDEO_DATASET_ROOT, requested_folder))

Web-Apps/WebNN/webnn-samples/image_classification_onnx/model_export.sh

@@ -2,11 +2,15 @@
 
 # install optimum exporters cli tools
 pip uninstall optimum
-pip install "optimum[exporters]==2.3.0"
+pip install "optimum[exporters]==2.3.0" \
+    --hash=sha256:3e9b217b4ab21fd4cf894a987002ee7d3626114e009592babf084c2f1a0f3b5f \
+    --hash=sha256:aa96ad535a5cec68d12c6372574125452284632fe13699633a61e8bbfb09c4df
 
 # downgrade huggingface_hub to work-around cached_download import error
 pip uninstall huggingface_hub
-pip install huggingface_hub==0.25.2
+pip install "huggingface_hub==0.25.2" \
+    --hash=sha256:1897caf88e7f97fe0110603d8f66ac264e3ba6accdf30cd66cc0fed5282ad25 \
+    --hash=sha256:a1014ea111a5f40ccd23f7f7ba8ac46e20fa3b658ced1f86a00c5c06ec6423c
 
 # export HF image classification models to ONNX
 optimum-cli export onnx --model google/mobilenet_v2_1.0_224 google_mobilenet_v2_1.0_224