Context
RestAPIServer::handleStaticFile in visualization/WebServer.cpp builds the file path by appending the raw URL path to the static root:
std::string filePath =
"visualization/static" + (path == "/" ? "/index.html" : path);There is no sanitization, so a request containing .. segments escapes the static directory and can read arbitrary files the process can access. The exposure is reduced by the server being a local dashboard, but anything on the same host (or network, if the port is exposed) can read files through it.
What to do
- Reject or normalize paths containing
.. (canonicalize with std::filesystem::weakly_canonical and verify the result is still under the static root).
- Return 403 or 404 for anything that resolves outside the root.
- Add unit tests covering
.. traversal, encoded traversal, and a normal file request.
Notes
Related to the static root also being cwd-relative (tracked separately).
Context
RestAPIServer::handleStaticFileinvisualization/WebServer.cppbuilds the file path by appending the raw URL path to the static root:std::string filePath = "visualization/static" + (path == "/" ? "/index.html" : path);There is no sanitization, so a request containing
..segments escapes the static directory and can read arbitrary files the process can access. The exposure is reduced by the server being a local dashboard, but anything on the same host (or network, if the port is exposed) can read files through it.What to do
..(canonicalize withstd::filesystem::weakly_canonicaland verify the result is still under the static root)...traversal, encoded traversal, and a normal file request.Notes
Related to the static root also being cwd-relative (tracked separately).