Update python sdk to strip any directory traversal in filename (#22965)

* update python sdk

Strip any directory traversal

* rebased

* update samples, docs

* fallback case

---------

Co-authored-by: Pavel Slabko <slabkopg@gmail.com>

Author: wing328

modules/openapi-generator/src/main/resources/python/api_client.mustache

@@ -724,7 +724,9 @@ class ApiClient:
                 content_disposition
             )
             assert m is not None, "Unexpected 'content-disposition' header value"
-            filename = m.group(1)
+            filename = os.path.basename(m.group(1))  # Strip any directory traversal
+            if filename in ("", ".", ".."):  # fall back to tmp filename
+                filename = os.path.basename(path)
             path = os.path.join(os.path.dirname(path), filename)
 
         with open(path, "wb") as f:

samples/client/echo_api/python-disallowAdditionalPropertiesIfNotPresent/openapi_client/api_client.py

@@ -708,7 +708,9 @@ def __deserialize_file(self, response):
                 content_disposition
             )
             assert m is not None, "Unexpected 'content-disposition' header value"
-            filename = m.group(1)
+            filename = os.path.basename(m.group(1))  # Strip any directory traversal
+            if filename in ("", ".", ".."):  # fall back to tmp filename
+                filename = os.path.basename(path)
             path = os.path.join(os.path.dirname(path), filename)
 
         with open(path, "wb") as f:

samples/client/echo_api/python/openapi_client/api_client.py

@@ -708,7 +708,9 @@ def __deserialize_file(self, response):
                 content_disposition
             )
             assert m is not None, "Unexpected 'content-disposition' header value"
-            filename = m.group(1)
+            filename = os.path.basename(m.group(1))  # Strip any directory traversal
+            if filename in ("", ".", ".."):  # fall back to tmp filename
+                filename = os.path.basename(path)
             path = os.path.join(os.path.dirname(path), filename)
 
         with open(path, "wb") as f:

samples/openapi3/client/petstore/python-aiohttp/petstore_api/api_client.py

@@ -717,7 +717,9 @@ def __deserialize_file(self, response):
                 content_disposition
             )
             assert m is not None, "Unexpected 'content-disposition' header value"
-            filename = m.group(1)
+            filename = os.path.basename(m.group(1))  # Strip any directory traversal
+            if filename in ("", ".", ".."):  # fall back to tmp filename
+                filename = os.path.basename(path)
             path = os.path.join(os.path.dirname(path), filename)
 
         with open(path, "wb") as f:

samples/openapi3/client/petstore/python-httpx/petstore_api/api_client.py

@@ -717,7 +717,9 @@ def __deserialize_file(self, response):
                 content_disposition
             )
             assert m is not None, "Unexpected 'content-disposition' header value"
-            filename = m.group(1)
+            filename = os.path.basename(m.group(1))  # Strip any directory traversal
+            if filename in ("", ".", ".."):  # fall back to tmp filename
+                filename = os.path.basename(path)
             path = os.path.join(os.path.dirname(path), filename)
 
         with open(path, "wb") as f:

samples/openapi3/client/petstore/python-lazyImports/petstore_api/api_client.py

@@ -714,7 +714,9 @@ def __deserialize_file(self, response):
                 content_disposition
             )
             assert m is not None, "Unexpected 'content-disposition' header value"
-            filename = m.group(1)
+            filename = os.path.basename(m.group(1))  # Strip any directory traversal
+            if filename in ("", ".", ".."):  # fall back to tmp filename
+                filename = os.path.basename(path)
             path = os.path.join(os.path.dirname(path), filename)
 
         with open(path, "wb") as f:

samples/openapi3/client/petstore/python/petstore_api/api_client.py

@@ -714,7 +714,9 @@ def __deserialize_file(self, response):
                 content_disposition
             )
             assert m is not None, "Unexpected 'content-disposition' header value"
-            filename = m.group(1)
+            filename = os.path.basename(m.group(1))  # Strip any directory traversal
+            if filename in ("", ".", ".."):  # fall back to tmp filename
+                filename = os.path.basename(path)
             path = os.path.join(os.path.dirname(path), filename)
 
         with open(path, "wb") as f: