Fix #2075125 [Private bug](https://bugs.launchpad.net/calibre/+bug/20…

…75125)
kovidgoyal · Jul 30, 2024 · bcd0ab1 · bcd0ab1
1 parent f3420c6
commit bcd0ab1
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/src/calibre/db/backend.py b/src/calibre/db/backend.py
@@ -2004,7 +2004,10 @@ def transform_format_filenames(src_path, dest_path):
 
     def copy_extra_file_to(self, book_id, book_path, relpath, stream_or_path):
         full_book_path = os.path.abspath(os.path.join(self.library_path, book_path))
-        src_path = make_long_path_useable(os.path.join(full_book_path, relpath))
+        extra_file_path = os.path.abspath(os.path.join(full_book_path, relpath))
+        if not extra_file_path.startswith(full_book_path):
+            raise FileNotFoundError(f'No data file {relpath} in book: {book_id}')
+        src_path = make_long_path_useable(extra_file_path)
         if isinstance(stream_or_path, str):
             shutil.copy2(src_path, make_long_path_useable(stream_or_path))
         else: