fix: embedding migration, worker error handling, path traversal security, response mismatches (unread-count, plugins, manifests), frontend type safety

2026-07-24 14:23:28 +02:00
parent c3c5233e58
commit 7b4a2c0791
10 changed files with 161 additions and 31 deletions
@@ -346,6 +346,10 @@ def create_app() -> FastAPI:
            # Don't intercept API routes
            if full_path.startswith(("api/", "docs", "openapi", "redoc")):
                raise HTTPException(status_code=404, detail="Not Found")
+            # Block path traversal and system file access
+            blocked_prefixes = ("var/log/", "error/", "error_log", "var/", "etc/", "proc/", "sys/")
+            if full_path.startswith(blocked_prefixes) or "/../" in full_path or full_path.endswith("/.."):
+                raise HTTPException(status_code=404, detail="Not Found")
            index_path = os.path.join(frontend_dist, "index.html")
            if os.path.isfile(index_path):
                return FileResponse(index_path)