Fix

Author: Sahil-u07

mkconcore.py

@@ -77,7 +77,8 @@
 def safe_name(value, context):
     """
     Validates that the input string does not contain characters dangerous 
-    for filesystem paths or shell command injection.
+    for simple names (labels, filenames without paths).
+    Use safe_path() for validating directory/file paths.
     """
     if not value:
         raise ValueError(f"{context} cannot be empty")
@@ -86,22 +87,36 @@ def safe_name(value, context):
         raise ValueError(f"Unsafe {context}: '{value}' contains illegal characters.")
     return value
 
-MKCONCORE_VER = "22-09-18"
-
-SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
-
-def _resolve_concore_path():
-    script_concore = os.path.join(SCRIPT_DIR, "concore.py")
-    if os.path.exists(script_concore):
-        return SCRIPT_DIR
-    cwd_concore = os.path.join(os.getcwd(), "concore.py")
-    if os.path.exists(cwd_concore):
-        return os.getcwd()
-    return SCRIPT_DIR
-
-GRAPHML_FILE = sys.argv[1]
-TRIMMED_LOGS = True
-CONCOREPATH = _resolve_concore_path()
+def safe_path(value, context):
+    """
+    Validates that a path string does not contain characters dangerous for shell command injection.
+    Unlike safe_name(), this allows path separators (/ and \) but still blocks dangerous shell metacharacters.
+    """
+    if not value:
+        raise ValueError(f"{context} cannot be empty")
+    # Allow path separators but block control characters and shell metacharacters
+    # Blocks: control chars, *, ?, <, >, |, ;, &, $, `, ', ", (, )
+    # Allows: /, \, -, _, ., alphanumeric, spaces, :
+    if re.search(r'[\x00-\x1F\x7F*?"<>|;&`$\'()]', value):
+        raise ValueError(f"Unsafe {context}: '{value}' contains illegal characters.")
+    return value
+
+MKCONCORE_VER = "22-09-18"
+
+SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
+
+def _resolve_concore_path():
+    script_concore = os.path.join(SCRIPT_DIR, "concore.py")
+    if os.path.exists(script_concore):
+        return SCRIPT_DIR
+    cwd_concore = os.path.join(os.getcwd(), "concore.py")
+    if os.path.exists(cwd_concore):
+        return os.getcwd()
+    return SCRIPT_DIR
+
+GRAPHML_FILE = sys.argv[1]
+TRIMMED_LOGS = True
+CONCOREPATH = _resolve_concore_path()
 CPPWIN    = "g++"        #Windows C++  6/22/21
 CPPEXE    = "g++"        #Ubuntu/macOS C++  6/22/21
 VWIN      = "iverilog"   #Windows verilog  6/25/21
@@ -142,8 +157,9 @@ def _resolve_concore_path():
 sourcedir = sys.argv[2]
 outdir = sys.argv[3]
 
-# Validate outdir argument
-safe_name(outdir, "Output directory argument")
+# Validate path arguments
+safe_path(outdir, "Output directory argument")
+safe_path(sourcedir, "Source directory argument")
 
 if not os.path.isdir(sourcedir):
     logging.error(f"{sourcedir} does not exist")