Potential fix for code scanning alert no. 427: Uncontrolled data used in path expression

[ZePan110]

Potential fix for https://github.com/opea-project/GenAIExamples/security/code-scanning/427
#2352
test pass https://github.com/opea-project/GenAIExamples/actions/runs/20253422487
How to, in general terms, fix the problem:
Paths provided by untrusted users must be checked before use. A common solution is to restrict file access to a known-safe directory. This is typically implemented by joining the user-supplied path to a safe root, normalizing the path, and ensuring the result still points inside the intended directory.

Detailed description of the single best way to fix the problem without changing existing functionality:

• In get_prompt_template, before using Path(template_path).read_text, validate or restrict template_path.
• Adopt the pattern used in QnAGenerator.prompt_handler: define a trusted root (e.g., /templates), join and normalize the path, and verify that the resulting path starts with the root.
• Only after such validation, read the file.
• This edit should appear in EdgeCraftRAG/edgecraftrag/utils.py in the get_prompt_template method, surrounding or replacing the existing read logic for template_path.

What is needed:

• Possibly an import of os.path if not present (already present).
• Insert safe path logic in get_prompt_template.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Files

None

[Copilot]

Pull request overview

This PR addresses a path traversal security vulnerability (code scanning alert #427) by implementing input validation for user-supplied template paths in the get_prompt_template function.

Key changes:

• Adds path validation logic to restrict file access to a safe root directory (/templates)
• Implements path normalization and bounds checking before reading template files
• Adds explicit error handling for invalid paths and missing files

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.