fix(import): resolve symlinks when checking the upload path

The temp root is resolve()d in settings but the file path was only
abspath()ed, so a symlink inside the temp folder could point outside it
and still pass the check. Resolve both sides the same way.

Also drop the unused /temp folder from the prod image.

app/apps/import_app/services/v1.py

@@ -1131,7 +1131,8 @@ class ImportService:
         Validates that the file path is within the allowed temporary directory.
         Returns the absolute path.
         """
-        abs_path = os.path.abspath(file_path)
+        # resolve() like IMPORT_TEMP_ROOT, so symlinks can't point outside it
+        abs_path = str(Path(file_path).resolve())
         if not Path(abs_path).is_relative_to(settings.IMPORT_TEMP_ROOT):
             raise ValueError(
                 f"Invalid file path. File must be in {settings.IMPORT_TEMP_ROOT}"

app/apps/import_app/tests/test_paths.py

@@ -149,3 +149,13 @@ class ImportTempRootTests(ImportObjectPermissionTestCase):
         ):
             with self.subTest(path=path), self.assertRaises(ValueError):
                 service._validate_file_path(str(path))
+
+    def test_service_rejects_symlinks_pointing_outside_temp_root(self):
+        link = self.temp_root / "link.csv"
+        try:
+            link.symlink_to("/etc/passwd")
+        except OSError:
+            self.skipTest("symlinks not available")
+
+        with self.assertRaises(ValueError):
+            self._service()._validate_file_path(str(link))

docker/prod/django/Dockerfile

@@ -69,9 +69,7 @@ RUN sed -i 's/\r$//g' /start && \
 COPY --chown=app:app ./app .
 
 RUN chown -R app:app /usr/src/app && \
-    chown -R app:app /usr/src/frontend && \
-    mkdir /temp && \
-    chown -R app:app /temp
+    chown -R app:app /usr/src/frontend
 
 USER app