jpmschweitzer/odysseus
1
0
Fork 0
mirror of https://github.com/pewdiepie-archdaemon/odysseus.git synced 2026-10-19 13:22:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): harden Python service boundaries

Browse Source
This commit is contained in:
Alexandre Teixeira
2026-10-06 03:16:54 +01:00
parent da3800b662
commit 3d91ad82cb
32 changed files with 1911 additions and 248 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mcp_servers/email_server.py
+17 -2
View File
@@ -3504,6 +3504,21 @@ def _block_sender(sender=None, uids=None, folder="INBOX", account=None, reason="
}
def _attachment_dir(folder, uid, account_id) -> Path:
"""Owner/account-scoped extraction directory (see src.mail_attachment_paths).
`folder` comes from tool arguments and the IMAP server's own mailbox names
(`/` hierarchies, absolute or `..` segments), so it must not become a path;
the old `MAIL_ATTACHMENTS_DIR/{folder}_{uid}` wrote outside the root and
shared one directory between every owner's "INBOX 42".
"""
from src.mail_attachment_paths import attachment_scope_dir
return attachment_scope_dir(
MAIL_ATTACHMENTS_DIR, folder, uid, owner=_current_owner(), account_id=account_id,
)
def _download_attachment(uid, index, folder="INBOX", account=None):
"""Extract a specific attachment to disk and return its local path."""
fixture = _fixture_attachment_source(uid, index, folder=folder, account=account)
@@ -3512,7 +3527,7 @@ def _download_attachment(uid, index, folder="INBOX", account=None):
filename = str(att.get("filename") or f"attachment-{index}.txt")
safe_name = re.sub(r"[^\w\s\-.]", "_", filename).strip() or f"attachment-{index}.txt"
content = str(att.get("content") or "")
target_dir = Path(MAIL_ATTACHMENTS_DIR) / re.sub(r"[^A-Za-z0-9._-]", "_", f"{folder}_{uid}")
target_dir = _attachment_dir(folder, uid, _row.get("account_id") or account)
path = target_dir / safe_name
size = len(content.encode("utf-8"))
try:
@@ -3545,7 +3560,7 @@ def _download_attachment(uid, index, folder="INBOX", account=None):
raw = msg_data[0][1]
msg = email.message_from_bytes(raw)
target_dir = Path(MAIL_ATTACHMENTS_DIR) / f"{folder}_{uid}"
target_dir = _attachment_dir(folder, uid, _load_config(account).get("account_id") or account)
filepath = _extract_attachment_to_disk(msg, index, target_dir)
if not filepath:
return {"error": f"Attachment index {index} not found"}