From 8856daf3c96b57f834d4f191eec4b1090f2861ba Mon Sep 17 00:00:00 2001 From: Pier-Jean Malandrino Date: Fri, 3 Apr 2026 13:03:21 +0200 Subject: [PATCH] Force .pdf extension on uploaded files regardless of user input The file content is already validated as PDF, so the user-supplied extension should not be trusted or written to disk. --- document-parser/services/document_service.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/document-parser/services/document_service.py b/document-parser/services/document_service.py index cba3d5c..bee24fb 100644 --- a/document-parser/services/document_service.py +++ b/document-parser/services/document_service.py @@ -32,7 +32,7 @@ async def upload(filename: str, content_type: str, file_content: bytes) -> Docum os.makedirs(UPLOAD_DIR, exist_ok=True) - ext = os.path.splitext(filename)[1] or ".pdf" + ext = ".pdf" # Content already validated as PDF safe_name = f"{uuid.uuid4()}{ext}" file_path = os.path.join(UPLOAD_DIR, safe_name)