Block local file paths at Campaign server boundaries

src/govoplan_campaign/backend/sending/execution.py

@@ -10,7 +10,8 @@ from sqlalchemy.orm import Session
 
 from govoplan_campaign.backend.db.models import Campaign, CampaignJob, CampaignVersion, JobValidationStatus
 from govoplan_campaign.backend.campaign.models import DeliveryConfig, ImapConfig, SmtpConfig
-from govoplan_campaign.backend.integrations import MailProfileError, mail_integration
+from govoplan_campaign.backend.integrations import MailProfileError, files_integration, mail_integration
+from govoplan_campaign.backend.path_security import CampaignPathSecurityError, assert_server_safe_campaign_paths
 
 SNAPSHOT_VERSION = "3"
 
@@ -250,6 +251,14 @@ def ensure_execution_snapshot(session: Session, version: CampaignVersion) -> Exe
     without a manual data migration.
     """
 
+    try:
+        assert_server_safe_campaign_paths(
+            version.raw_json if isinstance(version.raw_json, dict) else {},
+            managed_files_available=files_integration().available,
+        )
+    except CampaignPathSecurityError as exc:
+        raise ExecutionSnapshotError(str(exc)) from exc
+
     if isinstance(version.execution_snapshot, dict):
         snapshot = ExecutionSnapshot.model_validate(version.execution_snapshot)
         expected = snapshot_hash(snapshot.model_dump(mode="json"))