fix(export): add name sanitization (#8012)

Co-authored-by: Adrián Jesús Peña Rodríguez <adrianjpr@gmail.com>

api/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to the **Prowler API** are documented in this file.
 
+## [v1.8.5] (Prowler v5.7.5)
+
+### Fixed
+- Normalize provider UID to ensure safe and unique export directory paths [(#8007)](https://github.com/prowler-cloud/prowler/pull/8007).
+
+---
+
 ## [v1.8.4] (Prowler v5.7.4)
 
 ### Removed

api/pyproject.toml

@@ -35,7 +35,7 @@ name = "prowler-api"
 package-mode = false
 # Needed for the SDK compatibility
 requires-python = ">=3.11,<3.13"
-version = "1.8.4"
+version = "1.8.5"
 
 [project.scripts]
 celery = "src.backend.config.settings.celery"

api/src/backend/api/specs/v1.yaml

@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
   title: Prowler API
-  version: 1.8.4
+  version: 1.8.5
   description: |-
     Prowler API specification.
 

api/src/backend/api/v1/views.py

@@ -260,7 +260,7 @@ class SchemaView(SpectacularAPIView):
 
     def get(self, request, *args, **kwargs):
         spectacular_settings.TITLE = "Prowler API"
-        spectacular_settings.VERSION = "1.8.4"
+        spectacular_settings.VERSION = "1.8.5"
         spectacular_settings.DESCRIPTION = (
             "Prowler API specification.\n\nThis file is auto-generated."
         )

api/src/backend/tasks/jobs/export.py

@@ -1,4 +1,5 @@
 import os
+import re
 import zipfile
 
 import boto3
@@ -238,15 +239,18 @@ def _generate_output_directory(
         '/tmp/tenant-1234/aws/scan-5678/prowler-output-2023-02-15T12:34:56',
         '/tmp/tenant-1234/aws/scan-5678/compliance/prowler-output-2023-02-15T12:34:56'
     """
+    # Sanitize the prowler provider name to ensure it is a valid directory name
+    prowler_provider_sanitized = re.sub(r"[^\w\-]", "-", prowler_provider)
+
     path = (
         f"{output_directory}/{tenant_id}/{scan_id}/prowler-output-"
-        f"{prowler_provider}-{output_file_timestamp}"
+        f"{prowler_provider_sanitized}-{output_file_timestamp}"
     )
     os.makedirs("/".join(path.split("/")[:-1]), exist_ok=True)
 
     compliance_path = (
         f"{output_directory}/{tenant_id}/{scan_id}/compliance/prowler-output-"
-        f"{prowler_provider}-{output_file_timestamp}"
+        f"{prowler_provider_sanitized}-{output_file_timestamp}"
     )
     os.makedirs("/".join(compliance_path.split("/")[:-1]), exist_ok=True)
 

api/src/backend/tasks/tests/test_export.py

@@ -145,3 +145,22 @@ class TestOutputs:
 
         assert path.endswith(f"{provider}-{output_file_timestamp}")
         assert compliance.endswith(f"{provider}-{output_file_timestamp}")
+
+    def test_generate_output_directory_invalid_character(self, tmpdir):
+        from prowler.config.config import output_file_timestamp
+
+        base_tmp = Path(str(tmpdir.mkdir("generate_output")))
+        base_dir = str(base_tmp)
+        tenant_id = "t1"
+        scan_id = "s1"
+        provider = "aws/test@check"
+
+        path, compliance = _generate_output_directory(
+            base_dir, provider, tenant_id, scan_id
+        )
+
+        assert os.path.isdir(os.path.dirname(path))
+        assert os.path.isdir(os.path.dirname(compliance))
+
+        assert path.endswith(f"aws-test-check-{output_file_timestamp}")
+        assert compliance.endswith(f"aws-test-check-{output_file_timestamp}")