mengzhx/semantica
1
0
Fork 0
mirror of https://github.com/semantica-agi/semantica.git synced 2026-08-29 04:26:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Potential fix for pull request finding 'CodeQL / Uncontrolled data used in path expression'

Browse Source 
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
This commit is contained in:
Mohd Kaif
2026-04-12 15:34:50 +05:30
committed by GitHub
co-authored by Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
parent 7de2a2eb5e
commit 920c0e55d5
1 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
semantica/server.py
+10 -3
View File
@@ -188,12 +188,19 @@ async def serve_spa(full_path: str):
if full_path.startswith("api/"):
raise HTTPException(status_code=404, detail="API route not found")
requested_rel_path = Path(full_path)
if requested_rel_path.is_absolute() or ".." in requested_rel_path.parts:
normalized_path = os.path.normpath(full_path)
if (
normalized_path in ("", ".")
or os.path.isabs(normalized_path)
or normalized_path == ".."
or normalized_path.startswith(".." + os.sep)
):
raise HTTPException(status_code=400, detail="Invalid path")
# Ensure join remains relative to STATIC_DIR even if input includes leading separators
safe_rel_path = normalized_path.lstrip("/\\")
static_dir_resolved = STATIC_DIR.resolve()
requested_file = static_dir_resolved.joinpath(requested_rel_path).resolve(strict=False)
requested_file = (static_dir_resolved / safe_rel_path).resolve(strict=False)
# Prevent path traversal: reject any path that escapes STATIC_DIR
if not requested_file.is_relative_to(static_dir_resolved):