Detected path traversal attempt - Django/Heroku(Bucketeer)

I'm getting this error when trying to upload using FileField. I'm using Bucketeer on Heroku to upload to an AWS bucket. I've seen a few threads on this issue but haven't been able to figure it out.

The file upload view:

class UploadTicketAttachment(APIView):
    permission_classes = []
    parser_classes = (MultiPartParser, FormParser)

    def post(self, request, format=None):
        user = request.user
        serializer = AttachmentSerialiazer(data=request.data)
        if serializer.is_valid(raise_exception=True):
            serializer.validated_data['uploaded_by'] = user
            serializer.save()
            return Response(serializer.data['id'])
        else:
            return Response(f'{serializer.errors}, attachment upload failed')

The model:

class Attachment(models.Model):
    file = models.FileField(upload_to="/ticket_attachments", blank=True, null=True)
    created_on = models.CharField(max_length=20, null=True)
    uploaded_by = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE, null=True, related_name="uploaded_by")
    parent_ticket = models.ForeignKey(Ticket, on_delete=models.CASCADE, null=True, related_name="attachment")
    def __str__(self):
        return self.file.name

For the settings/bucketeer configuration I followed which uses django-storages:

https://dev.to/heroku/properly-managing-django-media-static-files-on-heroku-o2l

I don't think the issue is on that end since I set it up the exact same way in another project and it works fine with the only difference being that the other project uses ImageField instead of FileField.

Django version is 4.0.2. Any ideas? Thanks

Back to Top