Assert saved paths are in job folder. #342

openeo_driver/save_result.py

@@ -205,6 +205,7 @@ def create_flask_response(self) -> Response:
             asset = assets.popitem()[1]
             path = Path(asset["href"])
             mimetype = asset.get("type")
+            assert path.relative_to(tmp_dir)
             return send_from_directory(path.parent, path.name, mimetype=mimetype)