From 85d01c6a042b465a8d276c1a9cfa8b10b91e45ce Mon Sep 17 00:00:00 2001
From: Jaret Burkett <jaretburkett@gmail.com>
Date: Sun, 18 Oct 2026 13:05:41 -0600
Subject: [PATCH] Prevent possible traversal upstream through caption tags on
 captioner

---
 extensions_built_in/captioner/BaseCaptioner.py | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/extensions_built_in/captioner/BaseCaptioner.py b/extensions_built_in/captioner/BaseCaptioner.py
index bf9a575..c7c9441 100644
--- a/extensions_built_in/captioner/BaseCaptioner.py
+++ b/extensions_built_in/captioner/BaseCaptioner.py
@@ -19,8 +19,9 @@ from toolkit.train_tools import get_torch_dtype
 
 AITK_Status = Literal["running", "stopped", "error", "completed"]
 
-# prompt special token: <caption.ext> -> contents of the media file's sibling <stem>.ext
-_CAPTION_TOKEN_RE = re.compile(r"<caption\.([A-Za-z0-9_.-]+)>")
+# prompt special token: <caption.ext> -> contents of the media file's sibling <stem>.ext.
+# ext is dot-separated alphanumeric segments only: no separators, no empty segments (..)
+_CAPTION_TOKEN_RE = re.compile(r"<caption\.([A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*)>")
 
 
 class CaptionConfig:
@@ -162,11 +163,16 @@ class BaseCaptioner(BaseExtensionProcess):
         or blank when that file does not exist."""
         if not prompt or "<caption." not in prompt:
             return prompt
-        stem = os.path.splitext(file_path)[0]
+        media_dir = os.path.dirname(os.path.abspath(file_path))
+        stem = os.path.splitext(os.path.basename(file_path))[0]
 
         def sub(m):
+            target = os.path.join(media_dir, f"{stem}.{m.group(1)}")
+            # only a file sitting next to the media file is ever read
+            if os.path.dirname(os.path.abspath(target)) != media_dir:
+                return ""
             try:
-                with open(f"{stem}.{m.group(1)}", "r", encoding="utf-8") as f:
+                with open(target, "r", encoding="utf-8") as f:
                     return f.read().strip()
             except OSError:
                 return ""