fix(documentai-toolbox): contain split_pdf output to output_path (#18063)

split_pdf builds each output filename from entity.type_, which is read
straight from the parsed Document (loaded via from_gcs or
from_document_path). Document AI entity types can contain "/" (the
fixtures already carry "vat/tax_amount"), and a document whose type_ is
set to something like ../../../../tmp/pwned makes
os.path.join(output_path, output_filename) write the split PDF outside
output_path. The entity type is now flattened before it goes into the
filename, so the write stays inside output_path.

- [ ] Make sure to open an issue as a
[bug/issue](https://github.com/googleapis/google-cloud-python/issues)
before writing your code! That way we can discuss the change, evaluate
designs, and agree on the general idea
- [x] Ensure the tests and linter pass
- [x] Code coverage does not decrease (if any source code was changed)
- [ ] Appropriate docs were updated (if necessary)

Author: Samin061

packages/google-cloud-documentai-toolbox/google/cloud/documentai_toolbox/wrappers/document.py

@@ -823,7 +823,17 @@ def split_pdf(self, pdf_path: str, output_path: str) -> List[str]:
         input_filename, input_extension = os.path.splitext(os.path.basename(pdf_path))
         with Pdf.open(pdf_path) as pdf:
             for entity in self.entities:
-                subdoc_type = entity.type_ or "subdoc"
+                # Entity types come from the parsed Document and may contain
+                # path separators (e.g. "vat/tax_amount") or traversal
+                # sequences. Flatten them so the split file stays inside
+                # output_path. ":" is also flattened since it is not a valid
+                # filename character on Windows.
+                subdoc_type = (
+                    (entity.type_ or "subdoc")
+                    .replace("/", "_")
+                    .replace("\\", "_")
+                    .replace(":", "_")
+                )
                 page_range = (
                     f"pg{entity.start_page + 1}"
                     if entity.start_page == entity.end_page

packages/google-cloud-documentai-toolbox/tests/unit/test_document.py

@@ -790,6 +790,37 @@ def test_split_pdf_with_non_splitter(get_bytes_classifier_mock):
     get_bytes_classifier_mock.assert_called_once()
 
 
+@mock.patch("google.cloud.documentai_toolbox.wrappers.document.Pdf")
+def test_split_pdf_sanitizes_entity_type_path_traversal(
+    mock_Pdf, get_bytes_splitter_mock
+):
+    doc = document.Document.from_gcs(
+        gcs_bucket_name="test-directory", gcs_prefix="documentai/output/123456789/0"
+    )
+    mock_output_file = mock.Mock()
+    mock_Pdf.new.return_value = mock_output_file
+
+    # Entity types are read from the parsed Document and may carry path
+    # separators or traversal sequences.
+    doc.entities[0].type_ = "../../../../etc:passwd"
+
+    output_path = "splitter/output/"
+    actual = doc.split_pdf(
+        pdf_path="procurement_multi_document.pdf", output_path=output_path
+    )
+
+    get_bytes_splitter_mock.assert_called_once()
+
+    resolved_output = os.path.realpath(output_path)
+    for call in mock_output_file.save.call_args_list:
+        written_path = os.path.realpath(call.args[0])
+        assert written_path == resolved_output or written_path.startswith(
+            resolved_output + os.sep
+        )
+
+    assert actual[0] == "procurement_multi_document_pg1_.._.._.._.._etc_passwd.pdf"
+
+
 def test_convert_document_to_annotate_file_response():
     doc = document.Document.from_document_path(
         document_path="tests/unit/resources/0/toolbox_invoice_test-0.json"