From d0dd8b79554144208d403578e297eb9f49bc139a Mon Sep 17 00:00:00 2001 From: -LAN- Date: Mon, 23 Dec 2024 17:53:42 +0800 Subject: [PATCH] fix: add UUID validation for tool file ID extraction (#12011) Signed-off-by: -LAN- --- api/core/workflow/nodes/tool/tool_node.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/api/core/workflow/nodes/tool/tool_node.py b/api/core/workflow/nodes/tool/tool_node.py index 3b56f94876..983fa7e623 100644 --- a/api/core/workflow/nodes/tool/tool_node.py +++ b/api/core/workflow/nodes/tool/tool_node.py @@ -1,5 +1,6 @@ from collections.abc import Mapping, Sequence from typing import Any +from uuid import UUID from sqlalchemy import select from sqlalchemy.orm import Session @@ -231,6 +232,10 @@ class ToolNode(BaseNode[ToolNodeData]): url = str(response.message) transfer_method = FileTransferMethod.TOOL_FILE tool_file_id = url.split("/")[-1].split(".")[0] + try: + UUID(tool_file_id) + except ValueError: + raise ToolFileError(f"cannot extract tool file id from url {url}") with Session(db.engine) as session: stmt = select(ToolFile).where(ToolFile.id == tool_file_id) tool_file = session.scalar(stmt)