diff --git a/src/utils.py b/src/utils.py index 8458e97..35b32dd 100644 --- a/src/utils.py +++ b/src/utils.py @@ -164,7 +164,10 @@ def sanitize_filename(filename: str) -> str: # Remove consecutive dots to prevent directory traversal attempts like '..' filename = re.sub(r'\.{2,}', '.', filename) - + + # remove potential $( + filename = re.sub(r'\$\([\s\S]*?\)', '', filename) + # Ensure filename is not practically empty after sanitization if not filename.strip() or filename.strip().replace('.', '') == '': raise ValueError("Filename invalid after sanitization")