Sanitize connector filenames (#277)

Author: Adityav369

ee/services/connectors/base_connector.py

@@ -1,6 +1,9 @@
+import hashlib
+import re
 from abc import ABC, abstractmethod
 from io import BytesIO
-from typing import Any, Dict, Optional
+from pathlib import Path
+from typing import Any, Dict, Optional, Union
 
 from pydantic import BaseModel
 
@@ -27,6 +30,28 @@ class BaseConnector(ABC):
     @abstractmethod
     def __init__(self, user_morphik_id: str):
         self.user_morphik_id = user_morphik_id
+        # Safe identifier for filesystem use (no path separators or traversal sequences)
+        self.user_storage_id = self._sanitize_user_identifier(user_morphik_id)
+
+    @staticmethod
+    def _sanitize_user_identifier(user_morphik_id: str) -> str:
+        """Return a filesystem-safe identifier with collision resistance."""
+        safe_id = re.sub(r"[^A-Za-z0-9_-]", "_", user_morphik_id).strip("_")[:32]
+        hash_suffix = hashlib.sha256(user_morphik_id.encode("utf-8")).hexdigest()[:8]
+        if not safe_id:
+            return f"user_{hash_suffix}"
+        return f"{safe_id}_{hash_suffix}"
+
+    def _build_storage_path(self, base_dir: Union[str, Path], prefix: str, suffix: str) -> Path:
+        """Construct a normalized, directory-confined path for storing connector secrets."""
+        base_path = Path(base_dir)
+        base_path.mkdir(parents=True, exist_ok=True)
+        filename = f"{prefix}{self.user_storage_id}{suffix}"
+        base_resolved = base_path.resolve()
+        full_path = (base_resolved / filename).resolve()
+        if base_resolved not in full_path.parents and full_path != base_resolved:
+            raise ValueError("Unsafe storage path resolved outside of configured directory")
+        return full_path
 
     @abstractmethod
     async def get_auth_status(self) -> ConnectorAuthStatus:

ee/services/connectors/github_connector.py

@@ -1,6 +1,5 @@
 import logging
 import mimetypes
-import os
 from io import BytesIO
 from pathlib import Path
 from typing import TYPE_CHECKING, Any, Dict, List, Optional
@@ -32,9 +31,7 @@ def __init__(self, user_morphik_id: str):
         self._load_credentials()
 
     def _get_user_token_path(self) -> Path:
-        token_dir = Path(self.ee_settings.GITHUB_TOKEN_STORAGE_PATH)
-        os.makedirs(token_dir, exist_ok=True)
-        return token_dir / f"github_token_{self.user_morphik_id}.txt"
+        return self._build_storage_path(self.ee_settings.GITHUB_TOKEN_STORAGE_PATH, "github_token_", ".txt")
 
     def _save_credentials(self, access_token: str) -> None:
         token_path = self._get_user_token_path()

ee/services/connectors/google_drive_connector.py

@@ -1,7 +1,6 @@
 # This is the beginning of the GoogleDriveConnector implementation.
 
 import logging
-import os
 import pickle
 from io import BytesIO
 from pathlib import Path
@@ -33,10 +32,7 @@ def __init__(self, user_morphik_id: str):
         self._load_credentials()
 
     def _get_user_token_path(self) -> Path:
-        token_dir = Path(self.ee_settings.GOOGLE_TOKEN_STORAGE_PATH)
-        # Create the token directory if it doesn't exist
-        os.makedirs(token_dir, exist_ok=True)
-        return token_dir / f"gdrive_token_{self.user_morphik_id}.pickle"
+        return self._build_storage_path(self.ee_settings.GOOGLE_TOKEN_STORAGE_PATH, "gdrive_token_", ".pickle")
 
     def _save_credentials(self) -> None:
         if not self.creds:

ee/services/connectors/zotero_connector.py

@@ -1,6 +1,5 @@
 import json
 import logging
-import os
 from io import BytesIO
 from pathlib import Path
 from typing import Any, Dict, List, Optional
@@ -27,9 +26,7 @@ def __init__(self, user_morphik_id: str):
     def _get_user_credentials_path(self) -> Path:
         """Get the path to store user credentials."""
         # Use the same directory structure as Google Drive but for Zotero
-        token_dir = Path(self.ee_settings.GOOGLE_TOKEN_STORAGE_PATH)
-        os.makedirs(token_dir, exist_ok=True)
-        return token_dir / f"zotero_creds_{self.user_morphik_id}.json"
+        return self._build_storage_path(self.ee_settings.GOOGLE_TOKEN_STORAGE_PATH, "zotero_creds_", ".json")
 
     def _save_credentials(self) -> None:
         """Save credentials to file."""

ee/ui-component/lib/pdf-commands.ts

@@ -28,12 +28,21 @@ if (!globalThis.pdfSessions) {
 
 const sessions: Map<string, PDFSession> = globalThis.pdfSessions;
 
+const MAX_LOG_VALUE_LENGTH = 200;
+
+function sanitizeForLog(value: string): string {
+  if (!value) return "";
+  const trimmed = value.replace(/[\r\n\t]+/g, " ").replace(/[^\x20-\x7E]/g, "");
+  return trimmed.length > MAX_LOG_VALUE_LENGTH ? `${trimmed.slice(0, MAX_LOG_VALUE_LENGTH)}...` : trimmed;
+}
+
 // Clean up inactive sessions (older than 1 hour)
 function cleanupInactiveSessions() {
   const oneHourAgo = new Date(Date.now() - 60 * 60 * 1000);
   for (const [sessionId, session] of Array.from(sessions.entries())) {
     if (session.lastActivity < oneHourAgo) {
-      console.log(`Cleaning up inactive session: ${sessionId}`);
+      const safeSessionId = sanitizeForLog(sessionId);
+      console.log("Cleaning up inactive session:", safeSessionId);
       // Close all clients in the session
       session.clients.forEach((client: ReadableStreamDefaultController) => {
         try {
@@ -51,6 +60,8 @@ function cleanupInactiveSessions() {
 setInterval(cleanupInactiveSessions, 30 * 60 * 1000);
 
 export function getOrCreateSession(sessionId: string, userId: string): PDFSession {
+  const safeSessionId = sanitizeForLog(sessionId);
+  const safeUserId = sanitizeForLog(userId);
   let session = sessions.get(sessionId);
 
   if (!session) {
@@ -62,7 +73,7 @@ export function getOrCreateSession(sessionId: string, userId: string): PDFSessio
       lastActivity: new Date(),
     };
     sessions.set(sessionId, session);
-    console.log(`Created new PDF session: ${sessionId} for user: ${userId}`);
+    console.log("Created new PDF session", safeSessionId, "for user", safeUserId);
   } else {
     // Verify user owns this session (allow anonymous/authenticated user mixing for development)
     const isUserMatch =
@@ -84,20 +95,22 @@ export function getOrCreateSession(sessionId: string, userId: string): PDFSessio
 }
 
 export function addClient(controller: ReadableStreamDefaultController, sessionId: string, userId: string) {
-  console.log(`Adding new PDF API client for session: ${sessionId}, user: ${userId}`);
+  const safeSessionId = sanitizeForLog(sessionId);
+  const safeUserId = sanitizeForLog(userId);
+  console.log("Adding new PDF API client for session", safeSessionId, "user", safeUserId);
 
   const session = getOrCreateSession(sessionId, userId);
   session.clients.push(controller);
 
-  console.log(`Total clients in session ${sessionId}:`, session.clients.length);
+  console.log("Total clients in session", safeSessionId, session.clients.length);
 
   // Send initial connection message
   const connectionMessage = `data: ${JSON.stringify({ type: "connected", sessionId, userId })}\n\n`;
   console.log("Sending connection message:", connectionMessage);
   controller.enqueue(connectionMessage);
 
   // Send any queued commands for this session
-  console.log(`Sending queued commands for session ${sessionId}:`, session.commandQueue.length);
+  console.log("Sending queued commands for session", safeSessionId, session.commandQueue.length);
   session.commandQueue.forEach(command => {
     const message = `data: ${JSON.stringify(command)}\n\n`;
     console.log("Sending queued command:", message);
@@ -109,18 +122,19 @@ export function addClient(controller: ReadableStreamDefaultController, sessionId
 }
 
 export function removeClient(controller: ReadableStreamDefaultController, sessionId: string) {
-  console.log(`Removing PDF API client from session: ${sessionId}`);
+  const safeSessionId = sanitizeForLog(sessionId);
+  console.log("Removing PDF API client from session", safeSessionId);
 
   const session = sessions.get(sessionId);
   if (!session) {
-    console.log(`Session ${sessionId} not found`);
+    console.log("Session not found", safeSessionId);
     return;
   }
 
   const index = session.clients.indexOf(controller);
   if (index > -1) {
     session.clients.splice(index, 1);
-    console.log(`Client removed from session ${sessionId}. Remaining clients:`, session.clients.length);
+    console.log("Client removed from session", safeSessionId, "Remaining clients:", session.clients.length);
 
     // If no clients left in session, we could optionally clean it up
     // For now, we'll keep it for a while in case the client reconnects
@@ -131,11 +145,13 @@ export function removeClient(controller: ReadableStreamDefaultController, sessio
 
 // Function to broadcast commands to all connected clients in a specific session
 export function broadcastPDFCommand(command: PDFCommand, sessionId: string, userId: string) {
-  console.log(`Broadcasting PDF command to session ${sessionId}:`, command);
+  const safeSessionId = sanitizeForLog(sessionId);
+  const safeUserId = sanitizeForLog(userId);
+  console.log("Broadcasting PDF command to session", safeSessionId, "user", safeUserId, command);
 
   const session = sessions.get(sessionId);
   if (!session) {
-    console.log(`Session ${sessionId} not found, creating new session`);
+    console.log("Session not found, creating new session", safeSessionId, "user", safeUserId);
     getOrCreateSession(sessionId, userId);
     return broadcastPDFCommand(command, sessionId, userId);
   }
@@ -166,22 +182,22 @@ export function broadcastPDFCommand(command: PDFCommand, sessionId: string, user
   // Send to all connected clients in this session
   session.clients.forEach((controller, index) => {
     try {
-      console.log(`Sending command to client ${index + 1} in session ${sessionId}:`, message);
+      console.log("Sending command to client", index + 1, "in session", safeSessionId, message);
       controller.enqueue(message);
     } catch (error) {
-      console.error(`Error sending command to client ${index + 1} in session ${sessionId}:`, error);
+      console.error("Error sending command to client", index + 1, "in session", safeSessionId, error);
       // Remove failed client
       const clientIndex = session.clients.indexOf(controller);
       if (clientIndex > -1) {
         session.clients.splice(clientIndex, 1);
-        console.log(`Removed failed client from session ${sessionId}. Remaining clients: ${session.clients.length}`);
+        console.log("Removed failed client from session", safeSessionId, "Remaining clients:", session.clients.length);
       }
     }
   });
 
   // If no clients connected in this session, queue the command
   if (session.clients.length === 0) {
-    console.log(`No clients connected in session ${sessionId}, queueing command`);
+    console.log("No clients connected in session", safeSessionId, "queueing command");
     session.commandQueue.push(scopedCommand);
     // Keep only the last 10 commands to prevent memory issues
     if (session.commandQueue.length > 10) {

scripts/check_completeness.py

@@ -332,8 +332,9 @@ async def main():
         print(f"Using default namespace: {turbopuffer_namespace}")
         print("(You can specify a different namespace as: python check_completeness.py <namespace>)")
 
-    print(f"Using Supabase URI: {settings.POSTGRES_URI}")
-    print(f"Using TurboPuffer API key: {settings.TURBOPUFFER_API_KEY[:10]}...")
+    # Avoid printing secrets directly; just confirm they are configured.
+    print("Using Supabase URI: [configured]")
+    print("Using TurboPuffer API key: [configured]")
 
     print("Fetching data from Supabase...")
     try: