Merge pull request #6 from astroid-app/fix/aikido-security-sast--2017…

…762-9GqN

[Aikido Sensei] Fix for Potential file inclusion attack via reading file
Comment: attachment_path should be a static path, but you'll never know what may go wrong

src/astroidapi/attachment_processor.py

@@ -30,6 +30,8 @@ async def download_attachment(attachment_url, registeredPlatforms):
             await surrealdb_handler.AttachmentProcessor.create_attachment(attachment_id, status="downloading", type=attachment_type, registeredPlatforms=registeredPlatforms)
             attachment = response.content
             attachment_path = f"{pathlib.Path(__file__).parent.resolve()}/TMP_attachments/{attachment_id}.{attachment_type}"
+            if '../' in attachment_path or '..\\' in attachment_path:
+                raise Exception("Invalid file path")
             with open(attachment_path, 'wb') as file:
                 file.write(attachment)
                 file.close()