Clean files and catch file path escape. Ref #1894

tests/api/routes/compute/test_qemu_nodes.py

@@ -396,6 +396,13 @@ async def test_upload_image_forbiden_location(app: FastAPI, client: AsyncClient,
         assert response.status_code == status.HTTP_403_FORBIDDEN
 
 
+async def test_download_image_escape(app: FastAPI, client: AsyncClient, tmpdir) -> None:
+
+    file_path = "foo/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd"
+    response = await client.get(app.url_path_for("download_qemu_image", filename=file_path))
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+
+
 @pytest.mark.skipif(not sys.platform.startswith("win") and os.getuid() == 0, reason="Root can delete any image")
 async def test_upload_image_permission_denied(app: FastAPI, client: AsyncClient, images_dir: str) -> None: