FIX: sanitize metadata file name in azure_blob_storage_target

[jsong468]

Description

AzureBlobStorageTarget lets a prompt override the blob name via prompt_metadata["file_name"], and that value was concatenated unsanitized into the blob path. A value like ../../team-b/results.txt is canonicalized by Azure to escape the configured container prefix, allowing a write/overwrite outside the intended location. This validates file_name at the boundary and rejects anything that isn't a bare leaf name.

This is defense-in-depth, not a live exploit in PyRIT's current trust model: whoever sets file_name already holds the container credential, so no privilege boundary is crossed today. It matters for a shared multi-tenant deployment that relies on prefix-based isolation between teams; the fix hardens that boundary before it is depended upon.

Changes

• pyrit/prompt_target/azure_blob_storage_target.py
  • Add _sanitize_file_name() — rejects path separators and traversal (file_name != posixpath.basename(file_name), plus ./.. and backslash checks) with a ValueError.
  • Apply it where prompt_metadata["file_name"] is read, so a bad name fails before any upload (write primitive is blocked at the source, not at each consumer of the resulting URL).

Tests

• tests/unit/prompt_target/target/test_prompt_target_azure_blob_storage.py
  • Parametrized rejection test (../../admin/stolen.txt, sub/dir/file.txt, .., ., dir\file.txt, /abs.txt).
  • Pass-through test for a plain leaf name.
  • End-to-end test asserting a traversal file_name raises and _upload_blob_async is never called.

[romanlutz]

Thank you!