From 30d4b9e23f8dfee0286dc1afab7135ad1ae5d83e Mon Sep 17 00:00:00 2001
From: firestar5683 <168790843+firestar5683@users.noreply.github.com>
Date: Mon, 2 Nov 2026 00:40:42 -0600
Subject: [PATCH] Preserve Internal Athena Validation

---
 openpilot/system/athena/athenad.py | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/openpilot/system/athena/athenad.py b/openpilot/system/athena/athenad.py
index c4fdd7461e..fd26a8105e 100755
--- a/openpilot/system/athena/athenad.py
+++ b/openpilot/system/athena/athenad.py
@@ -667,6 +667,10 @@ def uploadFilesToUrls(files_data: list[UploadFileDict]) -> UploadFilesToUrlRespo
   items: list[UploadItemDict] = []
   failed: list[str] = []
   for file in files:
+    if len(file.fn) == 0 or file.fn[0] == '/' or '..' in file.fn or len(file.url) == 0:
+      failed.append(file.fn)
+      continue
+
     path = os.path.join(Paths.log_root(), file.fn)
     if not owns_recording(path, Paths.log_root()) or (not os.path.exists(path) and not os.path.exists(strip_zst_extension(path))):
       failed.append(file.fn)
@@ -722,6 +726,8 @@ def cancelUpload(upload_id: str | list[str]) -> dict[str, int | str]:
 
 @dispatcher.add_method(latitude=number(-90, 90), longitude=number(-180, 180))
 def setNavDestination(latitude: float, longitude: float) -> dict[str, int | str]:
+  if not (-90 <= latitude <= 90 and -180 <= longitude <= 180):
+    return {"success": 0, "error": "Invalid destination coordinates"}
   Params().put("NavDestination", {"latitude": latitude, "longitude": longitude}, block=True)
   return {"success": 1}
 
@@ -754,6 +760,9 @@ def startLocalProxy(global_end_event: threading.Event, remote_ws_uri: str, local
     if local_port == 8022:
       local_port = 22
 
+    if local_port not in LOCAL_PORT_WHITELIST:
+      raise Exception("Requested local port not whitelisted")
+
     cloudlog.debug("athena.startLocalProxy.starting")
 
     dongle_id = Params().get("DongleId")