Sanitized file_name and calib_id to prevent path traversal attacks

[ChaitanyaChute]

Fixes Issue #89

Summary

This PR fixes a path traversal vulnerability in app/routes/session.py where user-supplied inputs (file_name and calib_id) were directly used to construct file paths without validation.

Both values are now sanitized using sanitize_filename() before being used in filesystem operations.

Security Issue

Previously, file_name and calib_id were used directly in file paths:

file_path = base_path / file_name
calib_path = calib_dir / calib_id

Because these values came directly from user input, an attacker could exploit path traversal by submitting values such as:

../../etc/cron.d/malicious

This could allow writing files outside the intended directory and potentially overwrite sensitive system or application files.

---

Fix Implemented

A sanitize_filename() function is now applied to both file_name and calib_id before path construction.

The function:

• Removes directory components using os.path.basename
• Restricts characters to safe ones:
  • a-z
  • A-Z
  • 0-9
  • -
  • _
  • .

Files Modified

app/routes/session.py