mengzhx/semantica
1
0
Fork 0
mirror of https://github.com/semantica-agi/semantica.git synced 2026-08-29 04:26:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Potential fix for pull request finding 'CodeQL / Uncontrolled data used in path expression'

Browse Source 
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
This commit is contained in:
Mohd Kaif
2026-04-12 15:56:15 +05:30
committed by GitHub
co-authored by Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
parent 920c0e55d5
commit 5e6df93f64
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
semantica/server.py
+5 -1
View File
@@ -199,8 +199,12 @@ async def serve_spa(full_path: str):
# Ensure join remains relative to STATIC_DIR even if input includes leading separators
safe_rel_path = normalized_path.lstrip("/\\")
rel_parts = Path(safe_rel_path).parts
if any(part in ("", ".", "..") for part in rel_parts):
raise HTTPException(status_code=400, detail="Invalid path")
static_dir_resolved = STATIC_DIR.resolve()
requested_file = (static_dir_resolved / safe_rel_path).resolve(strict=False)
requested_file = (static_dir_resolved / Path(*rel_parts)).resolve(strict=False)
# Prevent path traversal: reject any path that escapes STATIC_DIR
if not requested_file.is_relative_to(static_dir_resolved):