Resolve uploaded image references for prompt enhancement

2026-09-21 15:03:11 +02:00
parent 5106d0d2ed
commit fd3f3f5979
2 changed files with 15 additions and 1 deletions
@@ -1410,7 +1410,12 @@ def _restore_qwen(profile: str) -> None:

 def _image_data_url(path: str) -> str:
    """Read one already validated local reference image as a data URL."""
-    with open(path, "rb") as handle:
+    image_root = os.path.abspath(IMAGE_DIR)
+    resolved = (os.path.abspath(path) if os.path.isabs(path)
+                else os.path.abspath(os.path.join(image_root, path)))
+    if os.path.commonpath((image_root, resolved)) != image_root:
+        raise RuntimeError("Referenzbild liegt außerhalb des Bildverzeichnisses")
+    with open(resolved, "rb") as handle:
        data = handle.read()
    if data.startswith(b"\x89PNG\r\n\x1a\n"):
        mime = "image/png"