fix: path traversal on /documents (NVBug 6553697)

[chloecrozier]

Summary

• Fixes unauthenticated path-traversal arbitrary file write on the AI vWS Sizing Advisor /documents upload path (NVBug 6553697).
• Validates collection_name / filenames and confines writes to INGESTOR_UPLOAD_ROOT via resolved-path checks.

Test plan

• Upload a normal PDF to /v1/documents with a valid collection_name — succeeds
• POST with collection_name like ../../tmp — rejected with 400
• Filename containing ../ is basename-sanitized / confined under upload root
• Bootstrap ingestion of existing vgpu_docs PDFs (names with spaces/parens) still works

[Copilot]

Pull request overview

Addresses a path-traversal arbitrary file write risk on the sizing advisor ingestor /documents endpoints by validating collection_name / filenames and confining upload paths under a resolved upload root directory.

Changes:

• Adds centralized path-validation helpers (path_security.py) to validate collection names and confine upload destinations under INGESTOR_UPLOAD_ROOT.
• Updates ingestor /documents endpoints to use safe path construction and return 400s for unsafe paths.
• Updates deletion logic and docs/changelog to reflect the new security behavior.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
community/ai-vws-sizing-advisor/src/utils.py	Adds basic collection_name/filename sanitization for deletion path keys (but still needs fixes for robustness and root alignment).
community/ai-vws-sizing-advisor/src/ingestor_server/server.py	Routes upload/write paths through safe helpers; adds request validation and maps unsafe paths to HTTP 400.
community/ai-vws-sizing-advisor/src/ingestor_server/path_security.py	New validation + resolved-path confinement utilities using INGESTOR_UPLOAD_ROOT.
community/ai-vws-sizing-advisor/README.md	Documents upload confinement and warns against exposing demo endpoints to untrusted networks.
community/ai-vws-sizing-advisor/CHANGELOG.md	Records the security fix in the changelog (NVBug 6553697).

Suppressed comments (2)

community/ai-vws-sizing-advisor/src/utils.py:612

• del_docs_vectorstore_langchain() still hard-codes /tmp-data/uploaded_files, but uploads are now confined under INGESTOR_UPLOAD_ROOT. If that env var is changed, deletes will build source_value keys that don’t match what was ingested, causing deletes to silently fail.

    upload_folder = f"/tmp-data/uploaded_files/{safe_collection}"

community/ai-vws-sizing-advisor/src/utils.py:623

• The Milvus delete expression is built with a single-quoted string literal. If source_value contains a double quote (or other characters the Milvus expr parser treats specially), this can break the expression or delete the wrong rows. Since filenames are user-controlled and validate_safe_filename() allows quotes, escape the value and use a consistent quoting strategy.

            source_value = os.path.join(upload_folder, safe_filename)
            if settings.vector_store.name == "milvus":
                # Delete Milvus Entities
                resp = vectorstore.col.delete(f"source['source_name'] == '{source_value}'")

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.