Codemod: path-traversal-join Semgrep

[clavedeluna]

running semgrep on pygoat

 ❯❱ python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join
 Data from request is passed to os.path.join() and to open(). This is a path traversal vulnerability,
 which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or 
 os.path.realpath or Path library. 
 Details: https://sg.run/Dovo 
 
 916┆ file=request.POST["blog"]
 917┆ try :
 918┆ dirname = os.path.dirname(__file__)
 919┆ filename = os.path.join(dirname, file)
 920┆ file = open(filename,"r")
 921┆ data = file.read()
 922┆ return render(request,"Lab/ssrf/ssrf_lab.html",{"blog":data})
 923┆ except:
 924┆ return render(request, "Lab/ssrf/ssrf_lab.html", {"blog": "No blog found"})
 

I don't believe we currently have a codemod for this pattern, but we could use deterministically try to implement the suggestion semgrep is giving us.