CVE-2023-47115: Cross-site Scripting Vulnerability on Avatar Upload

def hash_upload(instance, filename):
filename = str(uuid.uuid4())[0:8] + '-' + filename
return settings.AVATAR_PATH + '/' + filename <3>


def check_avatar(files):
images = list(files.items())
if not images:
return None

filename, avatar = list(files.items())[0]  # get first file
w, h = get_image_dimensions(avatar) <1>
if not w or not h:
raise forms.ValidationError("Can't read image, try another one")