From 11af13ce277713136d5d86ac8c083b0429dac9d2 Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Wed, 12 Aug 2026 23:40:24 +0000
Subject: [PATCH] harden: add path validation in config.py

User-controlled input used in file path for open() without sanitization
Addresses utils.custom.path-traversal-open
---
 scripts/contractInteraction/config.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/scripts/contractInteraction/config.py b/scripts/contractInteraction/config.py
index 1a4c77674..d52ef79c8 100644
--- a/scripts/contractInteraction/config.py
+++ b/scripts/contractInteraction/config.py
@@ -2,6 +2,7 @@
 from brownie.network.contract import InterfaceContainer
 import json
 from os import environ
+import re
 
 def loadConfig():
     global contracts, acct
@@ -14,7 +15,9 @@ def loadConfig():
         else: 
             acct = accounts.load("rskdeployer")
         netName = environ.get('DEV_NET_NAME')
-        if(netName != None): 
+        if(netName != None):
+            if not re.match(r'^[a-zA-Z0-9_-]+$', netName):
+                raise ValueError("Invalid DEV_NET_NAME value")
             configPath = "./scripts/contractInteraction/" + netName + "_contracts.json"
             configFile = open(configPath)
         else: