stemtrace 0.3.3__tar.gz → 0.3.5__tar.gz

{stemtrace-0.3.3 → stemtrace-0.3.5}/.bumpversion.toml

@@ -1,5 +1,5 @@
 [tool.bumpversion]
-current_version = "0.3.3"
+current_version = "0.3.5"
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)"
 serialize = ["{major}.{minor}.{patch}"]
 commit = true

{stemtrace-0.3.3 → stemtrace-0.3.5}/CHANGELOG.md

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.5] - 2026-10-09
+
+### Security
+- UI: fixed a path traversal in the static file handler. Crafted URLs could read any file the server process can access, not just the bundled frontend. When the UI is exposed without authentication (no form login or `auth_dependency`, which is the default for `stemtrace server` and the Docker image), no credentials were needed. All users should upgrade. If you can't upgrade right away, put the UI behind authentication or a reverse proxy that blocks it from untrusted networks.
+
+## [0.3.4] - 2026-06-25
+
+### Fixed
+- WebSocket: deny unauthenticated connections during the handshake instead of accepting and then closing them. The accept-then-close path half-opened the connection, so when an unauthenticated client (e.g. a port scanner) aborted mid-handshake, uvicorn's legacy `websockets` implementation ran `close()` on a protocol whose `transfer_data_task` was never set, raising `AttributeError: 'WebSocketProtocol' object has no attribute 'transfer_data_task'`. Closing before `accept()` rejects the handshake (HTTP 403) without opening the protocol object.
+- Form login: build the login form action and redirects as relative paths instead of absolute URLs, and derive the session cookie's `Secure` flag from `X-Forwarded-Proto`. Behind a TLS-terminating proxy that doesn't forward the scheme to the ASGI scope (e.g. uvicorn without `--forwarded-allow-ips`), absolute URLs were downgraded to `http://`, so the browser posted the login form over http, the proxy answered `301 -> https`, the POST body was dropped, and login silently failed (with a mixed-content warning). stemtrace now works behind such a proxy without requiring forwarded-headers configuration.
+
 ## [0.3.3] - 2026-03-20
 
 ### Added

{stemtrace-0.3.3 → stemtrace-0.3.5}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: stemtrace
-Version: 0.3.3
+Version: 0.3.5
 Summary: A lightweight Celery task flow visualizer
 Project-URL: Homepage, https://github.com/iansokolskyi/stemtrace
 Project-URL: Documentation, https://github.com/iansokolskyi/stemtrace#readme
@@ -56,7 +56,7 @@ Description-Content-Type: text/markdown
 
 **Zero-infrastructure Celery task flow visualizer**
 
-[![PyPI version](https://img.shields.io/badge/pypi-v0.3.3-darklime)](https://pypi.org/project/stemtrace)
+[![PyPI version](https://img.shields.io/badge/pypi-v0.3.5-darklime)](https://pypi.org/project/stemtrace)
 [![Python](https://img.shields.io/pypi/pyversions/stemtrace.svg)](https://pypi.org/project/stemtrace/)
 [![CI](https://github.com/iansokolskyi/stemtrace/actions/workflows/ci.yml/badge.svg)](https://github.com/iansokolskyi/stemtrace/actions/workflows/ci.yml)
 [![codecov](https://codecov.io/gh/iansokolskyi/stemtrace/graph/badge.svg)](https://codecov.io/gh/iansokolskyi/stemtrace)

{stemtrace-0.3.3 → stemtrace-0.3.5}/README.md

@@ -2,7 +2,7 @@
 
 **Zero-infrastructure Celery task flow visualizer**
 
-[![PyPI version](https://img.shields.io/badge/pypi-v0.3.3-darklime)](https://pypi.org/project/stemtrace)
+[![PyPI version](https://img.shields.io/badge/pypi-v0.3.5-darklime)](https://pypi.org/project/stemtrace)
 [![Python](https://img.shields.io/pypi/pyversions/stemtrace.svg)](https://pypi.org/project/stemtrace/)
 [![CI](https://github.com/iansokolskyi/stemtrace/actions/workflows/ci.yml/badge.svg)](https://github.com/iansokolskyi/stemtrace/actions/workflows/ci.yml)
 [![codecov](https://codecov.io/gh/iansokolskyi/stemtrace/graph/badge.svg)](https://codecov.io/gh/iansokolskyi/stemtrace)

{stemtrace-0.3.3 → stemtrace-0.3.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "stemtrace"
-version = "0.3.3"
+version = "0.3.5"
 description = "A lightweight Celery task flow visualizer"
 readme = "README.md"
 license = { text = "MIT" }

{stemtrace-0.3.3 → stemtrace-0.3.5}/src/stemtrace/__init__.py

@@ -43,7 +43,7 @@ if TYPE_CHECKING:
     from celery import Celery
     from fastapi import FastAPI
 
-__version__ = "0.3.3"
+__version__ = "0.3.5"
 __all__ = [
     "ConfigurationError",
     "StemtraceConfig",

{stemtrace-0.3.3 → stemtrace-0.3.5}/src/stemtrace/server/api/websocket.py

@@ -33,8 +33,12 @@ def create_websocket_router(
                 secret=form_auth_config.secret,
                 expected_username=form_auth_config.username,
             ):
-                # Close without registering the connection.
-                await websocket.accept()
+                # Deny the handshake without completing it. Accepting first and
+                # then closing half-opens the connection; if the unauthenticated
+                # client aborts during that dance, uvicorn's legacy websockets
+                # impl runs close() on a protocol whose transfer_data_task was
+                # never set and raises AttributeError. Closing before accept lets
+                # Starlette reject the handshake (HTTP 403) without opening it.
                 await websocket.close(code=1008)
                 return
 

{stemtrace-0.3.3 → stemtrace-0.3.5}/src/stemtrace/server/fastapi/login_routes.py

@@ -40,6 +40,20 @@ def _safe_next(next_path: str | None, *, default: str) -> str:
     return next_path
 
 
+def _request_is_https(request: Request) -> bool:
+    """Best-effort HTTPS detection that survives a TLS-terminating proxy.
+
+    Falls back to the ``X-Forwarded-Proto`` header when the ASGI scheme is
+    ``http`` because proxy headers weren't applied to the scope (e.g. uvicorn
+    without ``--forwarded-allow-ips``). The first value of a comma-separated
+    list is the original client scheme.
+    """
+    if request.url.scheme == "https":
+        return True
+    forwarded = request.headers.get("x-forwarded-proto", "")
+    return forwarded.split(",")[0].strip().lower() == "https"
+
+
 def _login_page_html(*, action_path: str, error: str | None, next_path: str) -> str:
     """Render the login page HTML from a template."""
     escaped_title = html.escape(_DEFAULT_TITLE, quote=True)
@@ -92,7 +106,10 @@ def create_login_router(
         next_path = _safe_next(
             request.query_params.get("next"), default=default_next_path
         )
-        action_path = str(request.url_for("stemtrace_login_submit"))
+        # Relative path (not an absolute URL): the browser submits using the
+        # page's own scheme/host, so a TLS-terminating proxy that doesn't
+        # forward the scheme can't downgrade the form action to http.
+        action_path = request.url_for("stemtrace_login_submit").path
         rendered_html = _login_page_html(
             action_path=action_path, error=error, next_path=next_path
         )
@@ -125,7 +142,7 @@ def create_login_router(
             qs = {"error": "Invalid username or password"}
             if next_param:
                 qs["next"] = next_param
-            login_url = str(request.url_for("stemtrace_login_page"))
+            login_url = request.url_for("stemtrace_login_page").path
             return RedirectResponse(
                 url=login_url + "?" + urllib.parse.urlencode(qs),
                 status_code=303,
@@ -141,7 +158,7 @@ def create_login_router(
             value=config.create_session_cookie_value(),
             httponly=True,
             samesite="lax",
-            secure=request.url.scheme == "https",
+            secure=_request_is_https(request),
             path=config.cookie_path,
         )
         return response
@@ -149,7 +166,7 @@ def create_login_router(
     @router.post("/logout", include_in_schema=False, name="stemtrace_logout")
     async def logout(request: Request) -> RedirectResponse:
         """Clear the session cookie and redirect to login."""
-        login_url = str(request.url_for("stemtrace_login_page"))
+        login_url = request.url_for("stemtrace_login_page").path
         response = RedirectResponse(url=login_url, status_code=303)
         response.delete_cookie(key=config.cookie_name, path=config.cookie_path)
         return response

{stemtrace-0.3.3 → stemtrace-0.3.5}/src/stemtrace/server/ui/frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "stemtrace-ui",
   "private": true,
-  "version": "0.3.3",
+  "version": "0.3.5",
   "type": "module",
   "scripts": {
     "dev": "vite",

{stemtrace-0.3.3 → stemtrace-0.3.5}/src/stemtrace/server/ui/static.py

@@ -4,7 +4,9 @@ from __future__ import annotations
 
 import json
 import logging
+import os
 import re
+import stat
 from pathlib import Path
 
 from fastapi import APIRouter, Request
@@ -160,6 +162,46 @@ def _rewrite_html_for_prefix(
     return html.replace("<head>", script)
 
 
+def _contained_frontend_path(path: str) -> str | None:
+    """Confine a request path to the frontend directory, lexically.
+
+    The request path is user-controlled. It is joined onto the resolved
+    frontend directory and normalized as a string (dot-segments collapsed,
+    no symlink resolution), then accepted only if the result is still under
+    that directory. The filesystem is never touched for the candidate before
+    this check passes. Symlinks inside the frontend directory are trusted and
+    followed when the file is served (they come from the installed package,
+    e.g. symlink-mode installs), since only the request path is untrusted.
+
+    Args:
+        path: Path parameter taken from the request URL.
+
+    Returns:
+        The normalized absolute path if it lies under the frontend directory
+        (it may not exist), or None if it escapes the directory.
+    """
+    base = os.path.realpath(_FRONTEND_DIR)
+    candidate = os.path.normpath(Path(base) / path)
+    # Plain string prefix check: an absolute request path, a drive change or
+    # a UNC path (Windows) all produce a candidate outside this prefix.
+    base_prefix = base if base.endswith(os.sep) else base + os.sep
+    if candidate != base and not candidate.startswith(base_prefix):
+        return None
+    return candidate
+
+
+def _is_regular_file(path: str) -> bool:
+    """Return True if path is an existing regular file (symlinks followed).
+
+    Any error while inspecting the path (missing file, name too long,
+    embedded NUL byte, permission denied) is treated as "not a file".
+    """
+    try:
+        return stat.S_ISREG(Path(path).stat().st_mode)
+    except (OSError, ValueError):
+        return False
+
+
 def get_static_router(*, show_logout: bool = False) -> APIRouter | None:
     """Create router for UI static files. Returns None if dist/ missing."""
     return get_static_router_with_base(None, show_logout=show_logout)
@@ -220,9 +262,17 @@ def get_static_router_with_base(
 
     @router.get("/{path:path}", response_model=None)
     async def serve_spa(path: str, request: Request) -> FileResponse | HTMLResponse:
-        """Serve static files or fall back to index.html for SPA routing."""
-        file_path = _FRONTEND_DIR / path
-        if file_path.exists() and file_path.is_file():
+        """Serve static files or fall back to index.html for SPA routing.
+
+        Only regular files under the frontend directory are served. Paths
+        that normalize to a location outside of it get a 404; any other path
+        that is not a servable file (missing, a directory, or not inspectable)
+        falls back to index.html so client-side routes keep working.
+        """
+        file_path = _contained_frontend_path(path)
+        if file_path is None:
+            return HTMLResponse("<h1>Not found</h1>", status_code=404)
+        if _is_regular_file(file_path):
             return FileResponse(file_path)
 
         index_path = _FRONTEND_DIR / "index.html"