Merge pull request #3919 from freedomofpress/reply-basename

only save basename of filename for a reply on API requests

securedrop/journalist_app/api.py

@@ -1,9 +1,10 @@
-from datetime import datetime, timedelta
-from functools import wraps
 import json
-from werkzeug.exceptions import default_exceptions  # type: ignore
 
+from datetime import datetime, timedelta
 from flask import abort, Blueprint, current_app, jsonify, request
+from functools import wraps
+from os import path
+from werkzeug.exceptions import default_exceptions  # type: ignore
 
 from db import db
 from journalist_app import utils
@@ -238,9 +239,10 @@ def all_source_replies(source_uuid):
                 return jsonify(
                     {'message': 'You must encrypt replies client side'}), 400
 
-            reply = Reply(user, source,
-                          current_app.storage.path(source.filesystem_id,
-                                                   filename))
+            # issue #3918
+            filename = path.basename(filename)
+
+            reply = Reply(user, source, filename)
             db.session.add(reply)
             db.session.add(source)
             db.session.commit()

securedrop/tests/test_journalist_api.py

@@ -653,6 +653,9 @@ def test_authorized_user_can_add_reply(journalist_app, journalist_api_token,
         assert reply.journalist_id == test_journo['id']
         assert reply.source_id == source_id
 
+        # regression test for #3918
+        assert '/' not in reply.filename
+
         source = Source.query.get(source_id)
 
         expected_filename = '{}-{}-reply.gpg'.format(