From cc9a7d097557c968c0505a276b3776828dc5d6a4 Mon Sep 17 00:00:00 2001 From: tomaioo Date: Wed, 22 Jul 2026 18:19:32 -0700 Subject: [PATCH] fix(security): potential command injection via os.environ The `getDesktop` function accesses `os.environ["USERPROFILE"]` without checking if the key exists or handling a `KeyError`. While not directly exploitable, relying on unvalidated environment variables for file path construction can lead to unexpected behavior or path traversal if the environment is manipulated. Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com> --- exporter/SynthesisFusionAddin/src/lib/OsHelper.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/exporter/SynthesisFusionAddin/src/lib/OsHelper.py b/exporter/SynthesisFusionAddin/src/lib/OsHelper.py index 3b97a4b891..c84cc329d1 100644 --- a/exporter/SynthesisFusionAddin/src/lib/OsHelper.py +++ b/exporter/SynthesisFusionAddin/src/lib/OsHelper.py @@ -31,10 +31,13 @@ def getDesktop() -> str: Returns: *str* -- Absolute Path to Desktop. """ + userprofile = os.environ.get("USERPROFILE") + if userprofile is None: + return os.path.join(os.path.expanduser("~"), "Desktop") if getOS() == "Windows": - return os.path.join(os.path.join(os.environ["USERPROFILE"]), "Desktop\\") + return os.path.join(userprofile, "Desktop\\") else: - return os.path.join(os.path.join(os.environ["USERPROFILE"]), "Desktop/") + return os.path.join(userprofile, "Desktop/") def getOS() -> str: