Allow slashes in export filename

[klakhov]

Motivation and context

How has this been tested?

Checklist

• I submit my changes into the develop branch
• I have added a description of my changes into the CHANGELOG file
• I have updated the documentation accordingly
• I have added tests to cover my changes
• I have linked related issues (see GitHub docs)
• I have increased versions of npm packages if it is necessary
  (cvat-canvas,
  cvat-core,
  cvat-data and
  cvat-ui)

License

• I submit my code changes under the same MIT License that covers the project.
  Feel free to contact the maintainers if that's a concern.

[bsekachev]

What if task name contains something like test task /../../.. or /root/?)

[klakhov]

If custom_name contains slashes sendfile from django replaces them with _, so everything is ok with local downloads.
But we need to check cloud storages.

[bsekachev]

@klakhov

The question not about sendfile, the question is about CVAT internal filesystem. Because before sendfile works, the file initially created within CVAT container.

[klakhov]

File initially created within CVAT container has nothing to do with filename provided by user.
cvat/apps/dataset_manager/views.py:

        cache_dir = get_export_cache_dir(db_instance)

        exporter = EXPORT_FORMATS[dst_format]
        output_base = '%s_%s' % ('dataset' if save_images else 'annotations',
            make_file_name(to_snake_case(dst_format)))
        output_path = '%s.%s' % (output_base, exporter.EXT)
        output_path = osp.join(cache_dir, output_path)

It is only used as final filename which is provided to user (attachment_filename)

• In case of LOCAL export, Django sendfile validates path and replaces all / with _
• In case of CLOUD_STORAGE export, if path is correct cat/dog/archive.zip, feature works as expected. Using relative paths seems to be prohibited. If path contains ../../, there will be an error. For example:

boto3.exceptions.S3UploadFailedError: Failed to upload /home/kirill/projects/cvat/data/tasks/12/export_cache/task_backup.zip to tmp/car/dog/../a.zip: An error occurred (XMinioInvalidResourceName) when calling the PutObject operation: Resource name contains bad components such as ".." or ".".