Block local file paths at Campaign server boundaries

src/govoplan_campaign/backend/persistence/versions.py

@@ -19,13 +19,14 @@ from govoplan_campaign.backend.db.models import (
     JobSendStatus,
 )
 from govoplan_campaign.backend.sending.execution import clear_execution_snapshot
-from govoplan_campaign.backend.integrations import mail_integration
+from govoplan_campaign.backend.integrations import files_integration, mail_integration
 from govoplan_campaign.backend.persistence.campaigns import (
     CampaignPersistenceError,
     _next_version_number,
     _write_campaign_snapshot,
     normalize_campaign_paths,
 )
+from govoplan_campaign.backend.path_security import assert_server_safe_campaign_paths
 
 
 class LockedCampaignVersionError(CampaignPersistenceError):
@@ -120,8 +121,8 @@ def minimal_campaign_json(*, external_id: str, name: str, description: str | Non
                 "sent_folder": "auto",
             },
             "credentials": {
-                "smtp": {"username": "", "password": ""},
-                "imap": {"username": "", "password": ""},
+                "smtp": {"username": "", "password": ""},  # nosec B105 - empty draft placeholder.
+                "imap": {"username": "", "password": ""},  # nosec B105 - empty draft placeholder.
             },
         },
         "recipients": {
@@ -371,6 +372,12 @@ def fork_campaign_version_for_edit(
         )
 
     base_json = raw_json if raw_json is not None else copy.deepcopy(source.raw_json)
+    assert_server_safe_campaign_paths(
+        base_json,
+        source_filename=source_filename,
+        source_base_path=source_base_path,
+        managed_files_available=files_integration().available,
+    )
     runtime_json = normalize_campaign_paths(base_json, source_base_path) if source_base_path else copy.deepcopy(base_json)
     mail_integration().assert_campaign_mail_policy_allows_json(session, tenant_id=tenant_id, raw_json=runtime_json, campaign_id=campaign.id)
 
@@ -522,6 +529,13 @@ def update_campaign_version(
     source_base_path: str | None = None,
     autosave: bool = False,
 ) -> CampaignVersion:
+    if raw_json is not None or source_filename is not None or source_base_path is not None:
+        assert_server_safe_campaign_paths(
+            raw_json if raw_json is not None else {},
+            source_filename=source_filename,
+            source_base_path=source_base_path,
+            managed_files_available=files_integration().available,
+        )
     version = get_campaign_version_for_tenant(session, tenant_id=tenant_id, campaign_id=campaign_id, version_id=version_id)
     campaign = _require_campaign(session, campaign_id)
     ensure_current_working_version(campaign, version, action="edit")