From 446a27ada894b67a0b2b7dd630543ec1e34f330a Mon Sep 17 00:00:00 2001
From: scaramallion <scaramallion@users.noreply.github.com>
Date: Tue, 31 Oct 2023 06:26:48 +1100
Subject: [PATCH] Change FileInstance to use a random UUID when adding to a
 FileSet (#1925)

* Update test with new path

* Update instance path in tutorial
---
 doc/release_notes/v3.0.0.rst | 3 +++
 doc/tutorials/filesets.rst   | 2 +-
 src/pydicom/fileset.py       | 4 +++-
 tests/test_fileset.py        | 4 +---
 4 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/doc/release_notes/v3.0.0.rst b/doc/release_notes/v3.0.0.rst
index 1f627b6f72..403a65f7bf 100644
--- a/doc/release_notes/v3.0.0.rst
+++ b/doc/release_notes/v3.0.0.rst
@@ -88,6 +88,9 @@ Fixes
 * Fixed pydicom codify error when relative path did not exist
 * Fixed the VR enum sometimes returning invalid values for Python 3.11+ (:issue:`1874`)
 * Fixed pixel data handler for Pillow 10.1 raising an AttributeError (:issue:`1907`)
+* Fixed a possible security issue with :class:`~pydicom.fileset.FileInstance` instances
+  being able to escape the temporary directory when being added to a
+  :class:`~pydicom.fileset.FileSet` (:issue:`1922`)
 
 Pydicom Internals
 -----------------
diff --git a/doc/tutorials/filesets.rst b/doc/tutorials/filesets.rst
index 195a8aec58..c860b741e0 100644
--- a/doc/tutorials/filesets.rst
+++ b/doc/tutorials/filesets.rst
@@ -319,7 +319,7 @@ accessed and loaded:
     >>> instance.for_addition
     True
     >>> instance.path
-    '/tmp/tmp0aalrzir/1.3.6.1.4.1.5962.1.1.1.1.1.20040119072730.12322'
+    '/tmp/tmp0aalrzir/86e6b75b-b764-46af-bec3-51698a8366f2'
     >>> type(instance.load())
     <class 'pydicom.dataset.FileDataset'>
 
diff --git a/src/pydicom/fileset.py b/src/pydicom/fileset.py
index 47b49839a8..487d505228 100644
--- a/src/pydicom/fileset.py
+++ b/src/pydicom/fileset.py
@@ -9,6 +9,7 @@
 import shutil
 from tempfile import TemporaryDirectory
 from typing import Optional, Union, Any, cast
+import uuid
 import warnings
 
 from pydicom.charset import default_encoding
@@ -719,6 +720,7 @@ class Flags:
             add: bool
             remove: bool
 
+        self._uuid = uuid.uuid4()
         self._flags = Flags()
         self._apply_stage("x")
         self._stage_path: Path | None = None
@@ -746,7 +748,7 @@ def _apply_stage(self, flag: str) -> None:
                 self._stage_path = None
             else:
                 self._flags.add = True
-                self._stage_path = self.file_set._stage["path"] / self.SOPInstanceUID
+                self._stage_path = self.file_set._stage["path"] / f"{self._uuid}"
 
         elif flag == "-":
             # add + remove = no change
diff --git a/tests/test_fileset.py b/tests/test_fileset.py
index 6b7e98acbe..363b6303a2 100644
--- a/tests/test_fileset.py
+++ b/tests/test_fileset.py
@@ -881,9 +881,7 @@ def test_path_add(self, ct, tdir):
         instance = fs._instances[0]
         assert instance.is_staged
         assert instance.for_addition
-        assert (Path(fs._stage["path"]) / Path(instance.SOPInstanceUID)) == Path(
-            instance.path
-        )
+        assert Path(fs._stage["path"]) / f"{instance._uuid}" == Path(instance.path)
         assert isinstance(instance.path, str)
 
     def test_path_move(self, dicomdir):