Sanitize buffered upload filenames

Merged
HA
3mo ago
+105-20

Description

close #6752
Buffered uploads previously preserved client-supplied path segments in UploadFile.path, while streamed uploads
normalized filenames to a basename.

This made rx.upload_files and rx.upload_files_chunk expose different filename/path behavior for the same multipart
filename, for example ../secret.txt.

This PR adds one shared filename sanitizer and uses it for both upload paths.

Changes

  • Add _sanitize_upload_filename to strip path segments from upload filenames.
  • Add _upload_file_from_starlette so buffered upload file construction is directly testable.
  • Use the shared sanitizer in both buffered and streamed upload handling.
  • Add tests for POSIX-style and Windows-style path segment filenames.

Checks

  • uv run pytest tests/units/components/core/test_upload.py -q
  • uv run ruff check packages/reflex-components-core/src/reflex_components_core/core/_upload.py tests/units/ components/core/test_upload.py
  • uv run ruff format --check packages/reflex-components-core/src/reflex_components_core/core/_upload.py tests/units/ components/core/test_upload.py
  • uv run pyright packages/reflex-components-core/src/reflex_components_core/core/_upload.py tests/units/components/ core/test_upload.py