🔒️(backend) resolve template files through a static allowlist

Snyk Code flags the f-string path built from the request extension as
a path traversal. The DRF ChoiceField already restricts the value but
static analysis cannot follow it. Selecting the file name from a
static mapping makes the sink independent from user input, and the
serializer choices now derive from that single mapping.

src/backend/core/api/serializers.py

@@ -15,7 +15,7 @@ from django.utils.translation import gettext_lazy as _
 from lasuite.drf.models.choices import LinkReachChoices, get_equivalent_link_definition
 from rest_framework import serializers
 
-from core import models
+from core import enums, models
 from core.api import utils
 from core.api.fields import SchemaField
 from core.storage import get_storage_compute_backend
@@ -550,11 +550,7 @@ class ItemSerializer(ListItemSerializer):
 class CreateItemSerializer(ItemSerializer):
     """Serializer used to create a new item"""
 
-    TEMPLATE_EXTENSION_CHOICES = [
-        ("odt", "odt"),
-        ("ods", "ods"),
-        ("odp", "odp"),
-    ]
+    TEMPLATE_EXTENSION_CHOICES = [(ext, ext) for ext in enums.TEMPLATE_FILES]
 
     policy = serializers.SerializerMethodField()
     title = serializers.CharField(max_length=255, required=False)

src/backend/core/api/viewsets.py

@@ -627,7 +627,7 @@ class ItemViewSet(
     def _create_file_from_template(self, item, extension):
         """Read template file and upload it to storage for the given item."""
         template_path = os.path.join(
-            settings.BASE_DIR, "assets", "file_templates", f"template.{extension}"
+            settings.BASE_DIR, "assets", "file_templates", enums.TEMPLATE_FILES[extension]
         )
 
         try:

src/backend/core/enums.py

@@ -11,6 +11,14 @@ from django.utils.translation import gettext_lazy as _
 # pylint: disable=no-member
 ALL_LANGUAGES = {language: _(name) for language, name in global_settings.LANGUAGES}
 
+# Mapping of the extensions accepted for file creation from a template to
+# the template file shipped in assets/file_templates.
+TEMPLATE_FILES = {
+    "odt": "template.odt",
+    "ods": "template.ods",
+    "odp": "template.odp",
+}
+
 # Mapping of file type categories to the filename extensions they group together.
 # Used to filter items by file type, the "other" category matching any unlisted extension.
 FILE_CATEGORY_EXTENSIONS = {