From 5e6df93f642b98a5166fcce80692a4dbf7c063f6 Mon Sep 17 00:00:00 2001
From: Mohd Kaif <98801504+KaifAhmad1@users.noreply.github.com>
Date: Sun, 12 Apr 2026 15:56:15 +0530
Subject: [PATCH] Potential fix for pull request finding 'CodeQL / Uncontrolled
 data used in path expression'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 semantica/server.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/semantica/server.py b/semantica/server.py
index 627d7191..b74eddfc 100644
--- a/semantica/server.py
+++ b/semantica/server.py
@@ -199,8 +199,12 @@ async def serve_spa(full_path: str):
 
     # Ensure join remains relative to STATIC_DIR even if input includes leading separators
     safe_rel_path = normalized_path.lstrip("/\\")
+    rel_parts = Path(safe_rel_path).parts
+    if any(part in ("", ".", "..") for part in rel_parts):
+        raise HTTPException(status_code=400, detail="Invalid path")
+
     static_dir_resolved = STATIC_DIR.resolve()
-    requested_file = (static_dir_resolved / safe_rel_path).resolve(strict=False)
+    requested_file = (static_dir_resolved / Path(*rel_parts)).resolve(strict=False)
 
     # Prevent path traversal: reject any path that escapes STATIC_DIR
     if not requested_file.is_relative_to(static_dir_resolved):