ds-server-lib 6.3.0__tar.gz → 6.3.2__tar.gz

{ds_server_lib-6.3.0 → ds_server_lib-6.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ds-server-lib
-Version: 6.3.0
+Version: 6.3.2
 Summary: Server library for owasp depscan
 Author-email: Team AppThreat <cloud@appthreat.com>
 License-Expression: MIT
@@ -20,12 +20,12 @@ Classifier: Topic :: Security
 Classifier: Topic :: Utilities
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: appthreat-vulnerability-db~=6.7.2
-Requires-Dist: custom-json-diff>=2.1.6
-Requires-Dist: quart>=0.20.0
-Requires-Dist: rich>=13.9.4
-Requires-Dist: ds-analysis-lib
+Requires-Dist: appthreat-vulnerability-db~=6.7.7
+Requires-Dist: custom-json-diff~=2.1.6
+Requires-Dist: quart~=0.20
+Requires-Dist: rich~=15.0.0
+Requires-Dist: ds-analysis-lib~=6.3.2
 Provides-Extra: dev
-Requires-Dist: pytest>=8.3.4; extra == "dev"
-Requires-Dist: pytest-asyncio>=1.2.0; extra == "dev"
-Requires-Dist: pytest-cov>=6.0.0; extra == "dev"
+Requires-Dist: pytest~=9.2.0; extra == "dev"
+Requires-Dist: pytest-asyncio~=1.4.1; extra == "dev"
+Requires-Dist: pytest-cov~=7.1.0; extra == "dev"

{ds_server_lib-6.3.0 → ds_server_lib-6.3.2}/pyproject.toml

@@ -1,16 +1,16 @@
 [project]
 name = "ds-server-lib"
-version = "6.3.0"
+version = "6.3.2"
 description = "Server library for owasp depscan"
 authors = [
     {name = "Team AppThreat", email = "cloud@appthreat.com"},
 ]
 dependencies = [
-    "appthreat-vulnerability-db~=6.7.2",
-    "custom-json-diff>=2.1.6",
-    "quart>=0.20.0",
-    "rich>=13.9.4",
-    "ds-analysis-lib"
+    "appthreat-vulnerability-db~=6.7.7",
+    "custom-json-diff~=2.1.6",
+    "quart~=0.20",
+    "rich~=15.0.0",
+    "ds-analysis-lib~=6.3.2"
 ]
 
 requires-python = ">=3.10"
@@ -32,9 +32,9 @@ classifiers = [
 
 [project.optional-dependencies]
 dev = [
-    "pytest>=8.3.4",
-    "pytest-asyncio>=1.2.0",
-    "pytest-cov>=6.0.0",
+    "pytest~=9.2.0",
+    "pytest-asyncio~=1.4.1",
+    "pytest-cov~=7.1.0",
 ]
 
 [project.urls]

{ds_server_lib-6.3.0 → ds_server_lib-6.3.2}/src/ds_server_lib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ds-server-lib
-Version: 6.3.0
+Version: 6.3.2
 Summary: Server library for owasp depscan
 Author-email: Team AppThreat <cloud@appthreat.com>
 License-Expression: MIT
@@ -20,12 +20,12 @@ Classifier: Topic :: Security
 Classifier: Topic :: Utilities
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: appthreat-vulnerability-db~=6.7.2
-Requires-Dist: custom-json-diff>=2.1.6
-Requires-Dist: quart>=0.20.0
-Requires-Dist: rich>=13.9.4
-Requires-Dist: ds-analysis-lib
+Requires-Dist: appthreat-vulnerability-db~=6.7.7
+Requires-Dist: custom-json-diff~=2.1.6
+Requires-Dist: quart~=0.20
+Requires-Dist: rich~=15.0.0
+Requires-Dist: ds-analysis-lib~=6.3.2
 Provides-Extra: dev
-Requires-Dist: pytest>=8.3.4; extra == "dev"
-Requires-Dist: pytest-asyncio>=1.2.0; extra == "dev"
-Requires-Dist: pytest-cov>=6.0.0; extra == "dev"
+Requires-Dist: pytest~=9.2.0; extra == "dev"
+Requires-Dist: pytest-asyncio~=1.4.1; extra == "dev"
+Requires-Dist: pytest-cov~=7.1.0; extra == "dev"

ds_server_lib-6.3.2/src/ds_server_lib.egg-info/requires.txt

@@ -0,0 +1,10 @@
+appthreat-vulnerability-db~=6.7.7
+custom-json-diff~=2.1.6
+quart~=0.20
+rich~=15.0.0
+ds-analysis-lib~=6.3.2
+
+[dev]
+pytest~=9.2.0
+pytest-asyncio~=1.4.1
+pytest-cov~=7.1.0

{ds_server_lib-6.3.0 → ds_server_lib-6.3.2}/src/server_lib/__init__.py

@@ -18,7 +18,10 @@ class ServerOptions:
     certfile: Optional[str] = None
     keyfile: Optional[str] = None
     debug: bool = False
-    max_content_length: int = 100 * 1024 * 1024  # 100MB
+    # Maximum request body size in bytes. None means no limit is configured
+    # (Flask leaves MAX_CONTENT_LENGTH unset); a non-int value such as the raw
+    # env string breaks Werkzeug's per-request size comparison.
+    max_content_length: Optional[int] = 100 * 1024 * 1024  # 100MB
     # Hack
     create_bom: Optional[Callable] = None
     custom_data_directory: Optional[str] = None

{ds_server_lib-6.3.0 → ds_server_lib-6.3.2}/src/server_lib/simple.py

@@ -2,12 +2,17 @@ import contextlib
 import ipaddress
 import json
 import os
+import re
 import socket
+import sys
 import tempfile
 from hmac import compare_digest
-from urllib.parse import urlparse
+from typing import cast
+from urllib.parse import urlparse, urlsplit
 
 from analysis_lib import VdrAnalysisKV
+from analysis_lib.config import SUPPORTED_BOM_PROFILES
+from analysis_lib.search import get_pkgs_by_scope
 from analysis_lib.utils import get_pkg_list
 from analysis_lib.vdr import VDRAnalyzer
 from custom_json_diff.lib.utils import file_write
@@ -33,10 +38,21 @@ def get_allowed_git_schemes(default_schemes=None):
 allowed_git_schemes = get_allowed_git_schemes()
 
 
+def _color_system():
+    """Translate CONSOLE_COLOR_SCHEME into a rich-acceptable value.
+
+    rich only accepts its fixed color-system names (or None); anything else
+    raises KeyError while constructing the Console, so an unrecognized value
+    (e.g. a typo) falls back to None for auto-detection.
+    """
+    scheme = os.getenv("CONSOLE_COLOR_SCHEME", "256")
+    return scheme if scheme in ("auto", "standard", "256", "truecolor", "windows") else None
+
+
 console = Console(
     log_time=False,
     log_path=False,
-    color_system=os.getenv("CONSOLE_COLOR_SCHEME", "256"),
+    color_system=_color_system(),
     tab_size=2,
     emoji=os.getenv("DISABLE_CONSOLE_EMOJI", "") not in ("true", "1"),
 )
@@ -46,6 +62,26 @@ MAX_PROJECT_TYPE_LENGTH = 64
 DEFAULT_MAX_BOM_FILE_SIZE = 100 * 1024 * 1024
 
 UPLOAD_SIZE_LIMIT_MESSAGE = "BOM file exceeds the configured size limit."
+PATH_NOT_ALLOWED_MESSAGE = "Path not allowed"
+PATH_NOT_FOUND_MESSAGE = "path must be an existing directory or BOM file."
+CROSS_SITE_MESSAGE = "Cross-site requests are not allowed."
+UNTRUSTED_HOST_HEADER_MESSAGE = (
+    "Host header not allowed. Set DEPSCAN_SERVER_TRUSTED_HOST_NAMES to reach the "
+    "server by this name, or set DEPSCAN_SERVER_API_KEY."
+)
+QUERY_SCAN_NEEDS_JSON_MESSAGE = (
+    "Send path and url in a JSON body, or set DEPSCAN_SERVER_API_KEY, when the server "
+    "is not reached through localhost or a loopback address."
+)
+PATH_NOT_STRING_MESSAGE = "path and url must be strings."
+# A value that cdxgen would read as an option, a URL, a package URL or an scp-style
+# git address rather than a file system path. One letter before ":" is a drive.
+NON_PATH_RE = re.compile(r"^(?:-|[A-Za-z][A-Za-z0-9+.-]+:|git@)")
+WINDOWS_RESERVED_NAMES = frozenset(
+    ["CON", "PRN", "AUX", "NUL", "CONIN$", "CONOUT$"]
+    + [f"{prefix}{n}" for prefix in ("COM", "LPT") for n in "123456789\u00b9\u00b2\u00b3"]
+)
+SERVER_TEMP_DIR_PREFIX = "depscan-server-"
 
 
 def _is_truthy(value):
@@ -88,6 +124,59 @@ def _is_allowed_scan_path(path: str, allowed_paths: list[str]) -> bool:
     return False
 
 
+def _is_path_within(path: str, parent_dir: str) -> bool:
+    """
+    Check whether ``path`` resolves to a location inside ``parent_dir``.
+
+    Both operands are fully resolved first so symlinks and relative segments
+    cannot be used to escape the parent directory.
+    """
+    try:
+        real_path = os.path.realpath(path)
+        real_parent = os.path.realpath(parent_dir)
+    except (OSError, ValueError):
+        return False
+    try:
+        return os.path.commonpath((real_path, real_parent)) == real_parent
+    except (OSError, ValueError):
+        return False
+
+
+def _revalidate_scan_path(path: str | None) -> bool:
+    """
+    Re-check a scan path against the configured allowlist at the point of use.
+
+    ``enforce_allowlists`` validates the requested path before the request is
+    dispatched, but the path is consumed later, once BOM generation is under
+    way. Re-resolving it immediately before every filesystem access keeps a
+    symlink that appears inside an allowed directory after the initial check
+    from redirecting the scan outside the allowlist.
+    """
+    allowed_paths = app.config.get("ALLOWED_PATHS")
+    if allowed_paths is None or not path:
+        return True
+    return _is_allowed_scan_path(path, allowed_paths)
+
+
+def _get_server_temp_dir() -> str:
+    """
+    Return the private directory used for this server's temporary BOM files.
+
+    The directory is created once per process with ``0o700`` permissions so
+    uploaded and generated BOMs are not exposed to other users or to sibling
+    containers that happen to share the system temporary directory.
+    """
+    temp_dir = app.config.get("SERVER_TEMP_DIR")
+    if temp_dir and os.path.isdir(temp_dir):
+        return temp_dir
+    temp_dir = tempfile.mkdtemp(
+        prefix=SERVER_TEMP_DIR_PREFIX, dir=os.getenv("DEPSCAN_TEMP_DIR") or None
+    )
+    os.chmod(temp_dir, 0o700)
+    app.config["SERVER_TEMP_DIR"] = temp_dir
+    return temp_dir
+
+
 def _get_config_int(config, *keys: str, default: int, logger=None) -> int:
     for key in keys:
         value = config.get(key)
@@ -127,7 +216,10 @@ def _is_private_target(hostname: str | None) -> bool:
         addr_info = socket.getaddrinfo(host, None, proto=socket.IPPROTO_TCP)
     except socket.gaierror:
         return True
-    resolved_ips = {entry[4][0] for entry in addr_info if entry[4]}
+    # The first sockaddr element is documented (and typed in getaddrinfo's
+    # docstring) as the resolved address string; typeshed widens it to
+    # int | str across the various family-specific overloads.
+    resolved_ips = {cast(str, entry[4][0]) for entry in addr_info if entry[4]}
     return not resolved_ips or any(_is_private_or_local_ip(ip_text) for ip_text in resolved_ips)
 
 
@@ -137,6 +229,10 @@ def _validate_remote_url(url: str, allowed_schemes: set[str], allow_private_urls
         return False, "URL scheme is not allowed."
     if not parsed.hostname:
         return False, "URL host is required."
+    # Credentials embedded in a scan URL would be handed to the BOM generator
+    # and, on a redirect, to whichever host it ends up talking to.
+    if parsed.username or parsed.password:
+        return False, "URL must not contain embedded credentials."
     if not allow_private_urls and _is_private_target(parsed.hostname):
         return False, "URL host resolves to a private, loopback, or otherwise restricted address."
     return True, ""
@@ -151,6 +247,10 @@ def _parse_project_types(project_type_value: str) -> list[str]:
             raise ValueError("project type is too long")
         if not all(ch.isalnum() or ch in ("-", "_", ".", "+") for ch in project_type):
             raise ValueError("project type contains unsupported characters")
+        # Each type follows "-t" on the cdxgen command line, so a value such as
+        # "--server" would become an option of its own.
+        if not project_type[0].isalnum():
+            raise ValueError("project type must start with a letter or digit")
         project_types.append(project_type)
         if len(project_types) > MAX_PROJECT_TYPES:
             raise ValueError("too many project types were supplied")
@@ -206,6 +306,126 @@ def _read_upload_with_limit(upload, max_bytes: int):
     return upload_content, ""
 
 
+def _is_cross_site_request(headers) -> bool:
+    """Tell whether a browser sent this request on behalf of another site.
+
+    A web page can make the operator's browser send GET requests and simple
+    POST requests to the server, so a page on any site could start scans on a
+    loopback server that has no API key. Browsers mark such requests with
+    ``Sec-Fetch-Site`` and, for POST and CORS requests, with ``Origin``.
+    ``same-site`` is refused as well, because every port on ``localhost`` is
+    the same site. curl, CI jobs and other API clients send neither header and
+    are not affected.
+    """
+    fetch_site = (headers.get("Sec-Fetch-Site") or "").strip().lower()
+    if fetch_site:
+        # The browser computes this header itself, so when it is present it
+        # decides. A reverse proxy that rewrites Host would otherwise make
+        # same-origin requests fail the Origin comparison below.
+        return fetch_site in ("cross-site", "same-site")
+    # Browsers send Sec-Fetch-* only to localhost, loopback and HTTPS
+    # addresses; for the rest, Origin is all there is.
+    origin = headers.get("Origin")
+    if origin is None:
+        return False
+    origin = origin.strip()
+    # Sandboxed frames and file:// pages send the literal "null".
+    if not origin or origin.lower() == "null":
+        return True
+    try:
+        origin_netloc = urlsplit(origin).netloc.lower()
+    except ValueError:
+        return True
+    return origin_netloc != (headers.get("Host") or "").strip().lower()
+
+
+def _trusted_host_names() -> set[str]:
+    """Host names from DEPSCAN_SERVER_TRUSTED_HOST_NAMES (a list or comma-separated)."""
+    value = app.config.get("TRUSTED_HOST_NAMES")
+    if not value:
+        return set()
+    items = value if isinstance(value, (list, tuple, set)) else str(value).split(",")
+    return {str(item).strip().rstrip(".").lower() for item in items if str(item).strip()}
+
+
+def _host_header_name(host_header: str) -> str | None:
+    """Return the lower-case host name from a Host header, without port or trailing dot."""
+    try:
+        hostname = urlsplit(f"//{host_header.strip()}").hostname
+    except ValueError:
+        return None
+    return hostname.rstrip(".").lower() if hostname else None
+
+
+def _is_loopback_host_name(hostname: str) -> bool:
+    if hostname == "localhost" or hostname.endswith(".localhost"):
+        return True
+    try:
+        address = ipaddress.ip_address(hostname)
+    except ValueError:
+        return False
+    if isinstance(address, ipaddress.IPv6Address) and address.ipv4_mapped:
+        address = address.ipv4_mapped
+    return address.is_loopback
+
+
+def _is_loopback_host_header(host_header: str | None) -> bool:
+    """Tell whether the request was addressed to localhost or a loopback address.
+
+    Browsers send ``Sec-Fetch-Site`` to such addresses, so the cross-site
+    check covers them. Requests without a Host header come from HTTP/1.0
+    clients, not browsers.
+    """
+    if not host_header:
+        return True
+    hostname = _host_header_name(host_header)
+    return bool(hostname) and _is_loopback_host_name(hostname)
+
+
+def _is_trusted_host_header(host_header: str | None, trusted_names: set[str]) -> bool:
+    """Tell whether the Host header names this server rather than a rebound domain.
+
+    In a DNS rebinding attack, a page on a domain the attacker controls points
+    that domain at 127.0.0.1, so the browser treats requests to the server as
+    same-origin and lets the page read the responses. The Host header still
+    carries the attacker's domain. ``localhost``, ``*.localhost`` and IP
+    literals cannot be rebound, so they are always accepted; any other name
+    must be listed in DEPSCAN_SERVER_TRUSTED_HOST_NAMES.
+    """
+    if not host_header:
+        # Browsers always send Host; only HTTP/1.0 clients leave it out.
+        return True
+    hostname = _host_header_name(host_header)
+    if not hostname:
+        return False
+    if hostname == "localhost" or hostname.endswith(".localhost"):
+        return True
+    try:
+        ipaddress.ip_address(hostname)
+        return True
+    except ValueError:
+        pass
+    return hostname in trusted_names
+
+
+def _is_windows_remote_or_device_path(path: str) -> bool:
+    """Tell whether a Windows path names a network share or a device.
+
+    Checking whether ``\\\\host\\share`` exists makes Windows connect to that
+    host over SMB and offer the server account's credentials. Device names
+    such as ``CON`` or ``\\\\.\\pipe\\x`` are not files and can block reads.
+    """
+    # UNC shares, \\?\ and \\.\ device paths, and the NT \??\ prefix, in any
+    # mix of slashes.
+    if re.match(r"^[\\/]([\\/]|\?\?[\\/])", path):
+        return True
+    for part in re.split(r"[\\/]", path):
+        stem = part.split(".", 1)[0].split(":", 1)[0].rstrip(" ").upper()
+        if stem in WINDOWS_RESERVED_NAMES:
+            return True
+    return False
+
+
 def _get_request_api_key() -> str | None:
     auth_header = request.headers.get("Authorization", "")
     if auth_header.startswith("Bearer "):
@@ -225,6 +445,23 @@ async def index():
 async def enforce_allowlists():
     logger_instance = app.config.get("LOGGER_INSTANCE")
     configured_api_key = app.config.get("API_KEY")
+    if _is_cross_site_request(request.headers):
+        if logger_instance:
+            logger_instance.warning(
+                "Blocked cross-site request (Origin %r, Sec-Fetch-Site %r).",
+                request.headers.get("Origin"),
+                request.headers.get("Sec-Fetch-Site"),
+            )
+        return {"error": "true", "message": CROSS_SITE_MESSAGE}, 403
+    # An API key already stops a rebound page, which cannot know the key.
+    if not configured_api_key and not _is_trusted_host_header(
+        request.headers.get("Host"), _trusted_host_names()
+    ):
+        if logger_instance:
+            logger_instance.warning(
+                "Blocked request for untrusted Host header %r.", request.headers.get("Host")
+            )
+        return {"error": "true", "message": UNTRUSTED_HOST_HEADER_MESSAGE}, 403
     if configured_api_key:
         request_api_key = _get_request_api_key()
         if not request_api_key or not compare_digest(str(configured_api_key), request_api_key):
@@ -243,20 +480,34 @@ async def enforce_allowlists():
                 logger_instance.warning(f"Blocked request from unauthorized host: {client_host}")
             return {"error": "true", "message": "Host not allowed"}, 403
     if request.path == "/scan":
+        # A browser can put path or url in the query string of a cross-site GET
+        # or simple POST. Browsers send Sec-Fetch-Site only to loopback and
+        # HTTPS addresses, so elsewhere the cross-site check above cannot see
+        # such a request, while a JSON body needs a CORS preflight that this
+        # server never grants.
+        if (
+            not configured_api_key
+            and (request.args.get("path") or request.args.get("url"))
+            and not _is_loopback_host_header(request.headers.get("Host"))
+        ):
+            return {"error": "true", "message": QUERY_SCAN_NEEDS_JSON_MESSAGE}, 403
+        path = request.args.get("path") or None
+        if path is None and request.method == "POST":
+            json_data = await request.get_json(silent=True)
+            if isinstance(json_data, dict) and json_data.get("path"):
+                path = json_data["path"]
+        if path is not None and not isinstance(path, str):
+            return {"error": "true", "message": PATH_NOT_STRING_MESSAGE}, 400
+        # Checked before any file system access, including the allowlist below.
+        if path and sys.platform == "win32" and _is_windows_remote_or_device_path(path):
+            return {"error": "true", "message": PATH_NOT_ALLOWED_MESSAGE}, 403
         allowed_paths = app.config.get("ALLOWED_PATHS")
         if allowed_paths is not None:
-            path = None
-            if request.args.get("path"):
-                path = request.args.get("path")
-            elif request.method == "POST":
-                json_data = await request.get_json(silent=True)
-                if isinstance(json_data, dict) and "path" in json_data:
-                    path = json_data["path"]
             if path:
                 if not _is_allowed_scan_path(path, allowed_paths):
                     if logger_instance:
                         logger_instance.warning(f"Blocked request for path: {path}")
-                    return {"error": "true", "message": "Path not allowed"}, 403
+                    return {"error": "true", "message": PATH_NOT_ALLOWED_MESSAGE}, 403
 
 
 @app.after_request
@@ -300,6 +551,7 @@ async def run_scan():
     suggest_mode = _is_truthy(q.get("suggest"))
     fuzzy_search = _is_truthy(q.get("fuzzy_search"))
     temp_paths = []
+    path_is_caller_supplied = True
     if q.get("url"):
         url = q.get("url")
     if q.get("path"):
@@ -325,6 +577,12 @@ async def run_scan():
     if params.get("profile"):
         profile = params.get("profile")
 
+    if (path is not None and not isinstance(path, str)) or (
+        url is not None and not isinstance(url, str)
+    ):
+        return {"error": "true", "message": PATH_NOT_STRING_MESSAGE}, 400
+    if project_type is not None and not isinstance(project_type, str):
+        return {"error": "true", "message": "project type must be a string."}, 400
     if not path and not url and (uploaded_bom_file.get("file", None) is None):
         return {
             "error": "true",
@@ -336,8 +594,16 @@ async def run_scan():
         project_type_list = _parse_project_types(project_type)
     except ValueError as exc:
         return {"error": "true", "message": str(exc)}, 400
+    # The profile is forwarded to cdxgen as a command line argument, so only
+    # the documented values are accepted here.
+    if profile not in SUPPORTED_BOM_PROFILES:
+        return {
+            "error": "true",
+            "message": f"profile must be one of {', '.join(SUPPORTED_BOM_PROFILES)}.",
+        }, 400
     cdxgen_server = app.config.get("CDXGEN_SERVER_URL")
     bom_file_path = None
+    bom_is_caller_file = False
     if uploaded_bom_file.get("file", None) is not None:
         bom_file = uploaded_bom_file["file"]
         bom_file_suffix = str(bom_file.filename).rsplit(".", maxsplit=1)[-1]
@@ -392,8 +658,15 @@ async def run_scan():
             )
         if logger_instance:
             logger_instance.debug("Processing uploaded file")
-        tmp_bom_file = tempfile.NamedTemporaryFile(delete=False, suffix=f".bom.{bom_file_suffix}")
+        tmp_bom_file = tempfile.NamedTemporaryFile(
+            delete=False,
+            suffix=f".bom.{bom_file_suffix}",
+            dir=_get_server_temp_dir(),
+        )
         path = tmp_bom_file.name
+        # The uploaded BOM now lives in the server's own temporary directory,
+        # so it is no longer a caller supplied path for allowlist purposes.
+        path_is_caller_supplied = False
         tmp_bom_file.close()
         temp_paths.append(path)
         file_write(path, bom_file_content)
@@ -403,9 +676,27 @@ async def run_scan():
         )
         if not is_valid_url:
             return {"error": "true", "message": validation_message}, 400
+    # Without a cdxgen server, a caller-supplied path is scanned locally, so it
+    # must name an existing directory or BOM file. Any other value would reach
+    # the local cdxgen as its source argument, where cdxgen could read it as a
+    # git URL or package URL that the url checks above never saw.
+    if path and path_is_caller_supplied:
+        if NON_PATH_RE.match(path):
+            return {"error": "true", "message": PATH_NOT_FOUND_MESSAGE}, 400
+        if os.path.exists(path):
+            # Windows resolves ".." in the text before touching the disk, so
+            # "x:y/../../file" exists even though "x:y" does not. Only the
+            # resolved path is passed on.
+            path = os.path.realpath(path)
+        elif not cdxgen_server:
+            return {"error": "true", "message": PATH_NOT_FOUND_MESSAGE}, 400
     # Path points to a project directory
     # Bug# 233. Path could be a url
     try:
+        if path_is_caller_supplied and not _revalidate_scan_path(path):
+            if logger_instance:
+                logger_instance.warning("Blocked request for path: %s", path)
+            return {"error": "true", "message": PATH_NOT_ALLOWED_MESSAGE}, 403
         if url or (path and os.path.isdir(path)):
             if url and not path and not cdxgen_server:
                 return (
@@ -416,7 +707,10 @@ async def run_scan():
                     400,
                     {"Content-Type": "application/json"},
                 )
-            with tempfile.NamedTemporaryFile(delete=False, suffix=".bom.json") as bfp:
+            server_temp_dir = _get_server_temp_dir()
+            with tempfile.NamedTemporaryFile(
+                delete=False, suffix=".bom.json", dir=server_temp_dir
+            ) as bfp:
                 temp_paths.append(bfp.name)
                 if create_bom:
                     bom_status = create_bom(
@@ -432,19 +726,51 @@ async def run_scan():
                             "deep": deep,
                         },
                     )
-                    if bom_status:
+                    # Use the path the generator says it wrote. The temp file
+                    # above always exists, so `os.path.exists` proves nothing
+                    # here and only the returned path is trustworthy.
+                    if bom_status.success and bom_status.primary:
+                        # Generators are expected to write inside the temporary
+                        # directory created for this request. Refusing anything
+                        # else keeps the response from returning the contents of
+                        # an unrelated file.
+                        if not _is_path_within(bom_status.primary, server_temp_dir):
+                            if logger_instance:
+                                logger_instance.warning(
+                                    "Discarding BOM written outside the server temporary "
+                                    "directory: %s",
+                                    bom_status.primary,
+                                )
+                            return (
+                                {
+                                    "error": "true",
+                                    "message": "Generated BOM was written to an unexpected location.",
+                                },
+                                500,
+                                {"Content-Type": "application/json"},
+                            )
                         if logger_instance:
                             logger_instance.debug(
-                                "BOM file was generated successfully at %s", bfp.name
+                                "BOM file was generated successfully at %s", bom_status.primary
                             )
-                        bom_file_path = bfp.name
+                        bom_file_path = bom_status.primary
                     elif logger_instance:
                         logger_instance.debug("Problem generating the SBOM for %s %s", url, path)
         # Path points to a SBOM file
         elif path and os.path.exists(path):
             bom_file_path = path
+            # An uploaded BOM was staged in the server's temporary directory.
+            bom_is_caller_file = path_is_caller_supplied
         # Direct purl-based lookups are not supported yet.
         if bom_file_path is not None:
+            # Final check before the BOM is opened and its contents returned.
+            # A generated BOM lives in the server's temporary directory, which
+            # was checked above; only a BOM file named by the caller is
+            # rechecked against the allowlist.
+            if bom_is_caller_file and not _revalidate_scan_path(bom_file_path):
+                if logger_instance:
+                    logger_instance.warning("Blocked request for path: %s", bom_file_path)
+                return {"error": "true", "message": PATH_NOT_ALLOWED_MESSAGE}, 403
             pkg_list, _ = get_pkg_list(bom_file_path)
             if not pkg_list:
                 if logger_instance:
@@ -452,6 +778,9 @@ async def run_scan():
             else:
                 if logger_instance:
                     logger_instance.debug("Scanning %d oss dependencies for issues", len(pkg_list))
+            # Categorize packages by CycloneDX scope (required/optional/excluded)
+            # so scope-based prioritization works in server mode just like the CLI.
+            scoped_pkgs = get_pkgs_by_scope(pkg_list)
             bom_data, bom_error = _load_bom_data(bom_file_path, max_bom_file_size)
             if not bom_data:
                 return (
@@ -465,10 +794,10 @@ async def run_scan():
                 pkg_aliases={},
                 purl_aliases={},
                 suggest_mode=suggest_mode,
-                scoped_pkgs={},
+                scoped_pkgs=scoped_pkgs,
                 no_vuln_table=True,
                 bom_file=bom_file_path,
-                pkg_list=[],
+                pkg_list=pkg_list,
                 direct_purls={},
                 reached_purls={},
                 console=console,
@@ -511,6 +840,7 @@ def run_server(options: ServerOptions):
     app.config["LOGGER_INSTANCE"] = options.logger
     app.config.setdefault("API_KEY", os.getenv("DEPSCAN_SERVER_API_KEY"))
     app.config.setdefault("ALLOW_PRIVATE_URLS", os.getenv("DEPSCAN_SERVER_ALLOW_PRIVATE_URLS"))
+    app.config.setdefault("TRUSTED_HOST_NAMES", os.getenv("DEPSCAN_SERVER_TRUSTED_HOST_NAMES"))
     app.config.setdefault(
         "ALLOW_UNAUTHENTICATED_BIND",
         os.getenv("DEPSCAN_SERVER_ALLOW_UNAUTHENTICATED_BIND"),