security: enforce multifile download path boundary

invokeai/app/services/download/download_default.py

@@ -189,10 +189,12 @@ def multifile_download(
             on_error=on_error,
         )
 
+        dest_root = dest.resolve()
         for part in parts:
             url = part.url
-            path = dest / part.path
-            assert path.is_relative_to(dest), "only relative download paths accepted"
+            path = (dest / part.path).resolve()
+            if not path.is_relative_to(dest_root):
+                raise ValueError("only relative download paths accepted")
             job = DownloadJob(
                 source=url,
                 dest=path,

tests/app/services/download/test_download_queue.py

@@ -315,14 +315,32 @@ def test_multifile_no_rel_paths(tmp_path: Path, mm2_session: Session) -> None:
         requests_session=mm2_session,
     )
 
-    with pytest.raises(AssertionError) as error:
+    with pytest.raises(ValueError) as error:
         queue.multifile_download(
             parts=[RemoteModelFile(url=AnyHttpUrl("http://www.civitai.com/models/12345"), path=Path("/etc/passwd"))],
             dest=tmp_path,
         )
     assert str(error.value) == "only relative download paths accepted"
 
 
+def test_multifile_no_parent_traversal_paths(tmp_path: Path, mm2_session: Session) -> None:
+    queue = DownloadQueueService(
+        requests_session=mm2_session,
+    )
+
+    with pytest.raises(ValueError) as error:
+        queue.multifile_download(
+            parts=[
+                RemoteModelFile(
+                    url=AnyHttpUrl("http://www.civitai.com/models/12345"),
+                    path=Path("../outside.safetensors"),
+                )
+            ],
+            dest=tmp_path,
+        )
+    assert str(error.value) == "only relative download paths accepted"
+
+
 @contextmanager
 def clear_config() -> Generator[None, None, None]:
     try: