-
Notifications
You must be signed in to change notification settings - Fork 976
fix: normalize paths in file router to prevent HTTPException with dotdot paths#8425
fix: normalize paths in file router to prevent HTTPException with dotdot paths#8425mscolnick merged 1 commit intomarimo-team:mainfrom
Conversation
Summary
Fixes a bug where create_asgi_app() fails with HTTPException when file paths contain .. components.
Problem: When using os.path.join(os.path.dirname(__file__), "..", "..", "ui") (as the FastAPI example does), _allowed_paths stored the un-normalized absolute path (preserving ..), while resolve_file_path() normalized it via os.path.normpath(). This mismatch caused HTTPException('File not found') during SessionManager initialization.
Fix: Normalize paths consistently using normalize_path() when building _allowed_paths in ListOfFilesAppFileRouter.__init__ and in register_allowed_file().
Fixes #8414
Test Plan
- Added regression test
test_list_of_files_resolves_dotdot_in_paththat creates a file router with a..path and verifiesresolve_file_path()succeeds - All 50 existing tests in
test_file_router.pypass
When file paths contain '..' components (e.g., from os.path.join with
'..'), _allowed_paths stored the un-normalized absolute path while
resolve_file_path() normalized it via os.path.normpath(). This mismatch
caused HTTPException('File not found') during SessionManager
initialization for the create_asgi_app() / FastAPI integration.
Normalize paths consistently using normalize_path() when building
_allowed_paths and in register_allowed_file().
Fixes marimo-team#8414
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
I have read the CLA Document and I hereby sign the CLA You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot. |
|
I have read the CLA Document and I hereby sign the CLA |
|
Thank you for looking at this issue and doing a PR, much appreciated. |