Skip to content

Ngwpc 9962 sanitize inputs try new branch #72

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
danielcumpton wants to merge 3 commits into from
Closed

Ngwpc 9962 sanitize inputs try new branch #72

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
16c5e5e
sanitize geopackage path and change print statements to log statments
danielcumpton Mar 13, 2026
41abc2f
fix path datatype
danielcumpton Mar 20, 2026
9dc2a71
Merge remote-tracking branch 'origin/main' into ngwpc-9962_sanitize_i…
danielcumpton Mar 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 14 additions & 4 deletions app/routers/hydrofabric/router.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,6 @@
import logging
import pathlib
import re
import sqlite3
import tempfile
import uuid
Expand Down Expand Up @@ -34,6 +36,9 @@
QueryIdType,
)

logger = logging.getLogger(__name__)
logger.setLevel(logging.INFO)

api_router = APIRouter(prefix="/hydrofabric")


Expand Down Expand Up @@ -95,7 +100,12 @@
"""
unique_id = str(uuid.uuid4())[:8]
temp_dir = pathlib.Path(tempfile.gettempdir())
tmp_path = temp_dir / f"subset_{identifier}_{unique_id}.gpkg"
#create sanitized path and filename
identifier_clean = re.sub(r"[^A-Za-z0-9_]", "_", identifier)
tmp_path = temp_dir / f"subset_{identifier_clean}_{unique_id}.gpkg"
tmp_path = tmp_path.resolve()

Check failure

Code scanning / CodeQL

Uncontrolled data used in path expression High

This path depends on a
user-provided value
Loading
.

Copilot Autofix

AI 18 days ago

Copilot could not generate an autofix suggestion

Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.

if not str(tmp_path).startswith(str(temp_dir)):
raise Exception("temporary path for geopackages not allowed")

# Resolve namespace from domain/source combination (outside try block for error handling access)
try:
Expand Down Expand Up @@ -182,21 +192,21 @@
else:
nonspatial_layers[table_name] = layer_data
else:
print(f"Warning: {table_name} layer is empty")
logger.warning(f"Warning: {table_name} layer is empty")

# Write spatial layers first with pyogrio
for table_name, layer_data in spatial_layers.items():
pyogrio.write_dataframe(layer_data, tmp_path, layer=table_name)
layers_written += 1
print(f"Written spatial layer '{table_name}' with {len(layer_data)} records")
logger.info(f"Written spatial layer '{table_name}' with {len(layer_data)} records")

# Then write non-spatial layers with sqlite3
if nonspatial_layers:
conn = sqlite3.connect(tmp_path)
for table_name, layer_data in nonspatial_layers.items():
layer_data.to_sql(table_name, conn, if_exists="replace", index=False)
layers_written += 1
print(f"Written non-spatial layer '{table_name}' with {len(layer_data)} records")
logger.info(f"Written non-spatial layer '{table_name}' with {len(layer_data)} records")
conn.close()

if layers_written == 0:
Expand Down
Loading