[FIX] Filename secure escape

Author: whikernel

iris_evtx/IrisEVTXInterface.py

@@ -20,12 +20,13 @@
 
 import traceback
 from pathlib import Path
-from celery import chain, current_app
+from werkzeug.utils import secure_filename
 
-from iris_interface.IrisModuleInterface import IrisPipelineTypes, IrisModuleInterface, IrisModuleTypes
 import iris_interface.IrisInterfaceStatus as InterfaceStatus
-from iris_evtx.EVTXImportDispatcher import ImportDispatcher
+from iris_interface.IrisModuleInterface import IrisPipelineTypes, IrisModuleInterface, IrisModuleTypes
+
 import iris_evtx.IrisEVTXModConfig as interface_conf
+from iris_evtx.EVTXImportDispatcher import ImportDispatcher
 
 
 class IrisEVTXInterface(IrisModuleInterface):
@@ -68,7 +69,9 @@ def pipeline_files_upload(self, base_path, file_handle, case_customer, case_name
         """
 
         if base_path and Path(base_path).is_dir:
-            file_handle.save(Path(base_path, file_handle.filename))
+            # Sanitize the filename
+            file_name = secure_filename(file_handle.filename)
+            file_handle.save(Path(base_path, file_name))
             return InterfaceStatus.I2Success("Successfully saved file {} to {}".format(file_handle.filename, base_path))
 
         else:

requirements.txt

@@ -2,4 +2,5 @@ setuptools~=46.1.3
 celery~=4.4.7
 pyunpack~=0.2.2
 evtx2splunk~=2.0.1
-iris_interface==1.2.0
+iris_interface==1.2.0
+werkzeug