fix api_client.mustache

padznich · padznich · commit 86221f844feb · 2026-01-15T13:43:06.000+01:00
filename = os.path.basename(m.group(1))
diff --git a/modules/openapi-generator/src/main/resources/python/api_client.mustache b/modules/openapi-generator/src/main/resources/python/api_client.mustache
@@ -723,7 +723,7 @@ class ApiClient:
                 content_disposition
             )
             assert m is not None, "Unexpected 'content-disposition' header value"
-            filename = m.group(1)
+            filename = os.path.basename(m.group(1))  # Strip any directory traversal
             path = os.path.join(os.path.dirname(path), filename)
 
         with open(path, "wb") as f:

Original file line number	Diff line number	Diff line change
`@@ -723,7 +723,7 @@ class ApiClient:`
`723`	`723`	`content_disposition`
`724`	`724`	`)`
`725`	`725`	`assert m is not None, "Unexpected 'content-disposition' header value"`
`726`		`- filename = m.group(1)`
	`726`	`+ filename = os.path.basename(m.group(1)) # Strip any directory traversal`
`727`	`727`	`path = os.path.join(os.path.dirname(path), filename)`
`728`	`728`
`729`	`729`	`with open(path, "wb") as f:`