tPj @dZddlZddlmZdededefdZdedefd Zy) z Safe filesystem path construction for user-controlled inputs. Use safe_join() instead of os.path.join() whenever a path component comes from user input (request parameters, uploaded filenames, etc.) to prevent directory traversal attacks. N)Finalbase_dirpartsreturncZ|D]}d|vstdtjj|}tjjtjj|g|}|j |tj zs||k(std|d||S)a Join path components and verify the result stays within base_dir. Resolves symlinks and '..' sequences, then checks the final path is a descendant of base_dir. Raises ValueError if traversal is detected. Args: base_dir: The trusted base directory. *parts: User-controlled path components to append. Returns: The resolved absolute path as a string. Raises: ValueError: If the resolved path escapes base_dir. zPath contains null bytezPath z escapes base directory ) ValueErrorospathrealpathjoin startswithsep)rrpartbaseresolveds j/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/common_utils/path_utils.py safe_joinr s$8 T>67 78''""8,Dgg&&rww||D'A5'ABH   rvv .(d2B5 ,DTHMNN Ofilenamecd|vr td|jddjddd}|r|dvr td|S) a Extract a safe filename from a user-supplied path. Strips all directory components (both Unix and Windows separators), returning only the final name. Use this for uploaded file names before writing to disk. Args: filename: User-supplied filename (may contain path separators). Returns: The basename only, with no directory components. Raises: ValueError: If the resulting filename is empty or contains null bytes. rzFilename contains null byte\/).z..zEmpty or unsafe filename)r replacersplit)rnames r safe_filenamer )sW"677""4-44S!r%s? SS8CCr