stemtrace 0.3.4__tar.gz → 0.3.5__tar.gz

{stemtrace-0.3.4 → stemtrace-0.3.5}/.bumpversion.toml

@@ -1,5 +1,5 @@
 [tool.bumpversion]
-current_version = "0.3.4"
+current_version = "0.3.5"
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)"
 serialize = ["{major}.{minor}.{patch}"]
 commit = true

{stemtrace-0.3.4 → stemtrace-0.3.5}/CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.5] - 2026-10-09
+
+### Security
+- UI: fixed a path traversal in the static file handler. Crafted URLs could read any file the server process can access, not just the bundled frontend. When the UI is exposed without authentication (no form login or `auth_dependency`, which is the default for `stemtrace server` and the Docker image), no credentials were needed. All users should upgrade. If you can't upgrade right away, put the UI behind authentication or a reverse proxy that blocks it from untrusted networks.
+
 ## [0.3.4] - 2026-06-25
 
 ### Fixed

{stemtrace-0.3.4 → stemtrace-0.3.5}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: stemtrace
-Version: 0.3.4
+Version: 0.3.5
 Summary: A lightweight Celery task flow visualizer
 Project-URL: Homepage, https://github.com/iansokolskyi/stemtrace
 Project-URL: Documentation, https://github.com/iansokolskyi/stemtrace#readme
@@ -56,7 +56,7 @@ Description-Content-Type: text/markdown
 
 **Zero-infrastructure Celery task flow visualizer**
 
-[![PyPI version](https://img.shields.io/badge/pypi-v0.3.4-darklime)](https://pypi.org/project/stemtrace)
+[![PyPI version](https://img.shields.io/badge/pypi-v0.3.5-darklime)](https://pypi.org/project/stemtrace)
 [![Python](https://img.shields.io/pypi/pyversions/stemtrace.svg)](https://pypi.org/project/stemtrace/)
 [![CI](https://github.com/iansokolskyi/stemtrace/actions/workflows/ci.yml/badge.svg)](https://github.com/iansokolskyi/stemtrace/actions/workflows/ci.yml)
 [![codecov](https://codecov.io/gh/iansokolskyi/stemtrace/graph/badge.svg)](https://codecov.io/gh/iansokolskyi/stemtrace)

{stemtrace-0.3.4 → stemtrace-0.3.5}/README.md

@@ -2,7 +2,7 @@
 
 **Zero-infrastructure Celery task flow visualizer**
 
-[![PyPI version](https://img.shields.io/badge/pypi-v0.3.4-darklime)](https://pypi.org/project/stemtrace)
+[![PyPI version](https://img.shields.io/badge/pypi-v0.3.5-darklime)](https://pypi.org/project/stemtrace)
 [![Python](https://img.shields.io/pypi/pyversions/stemtrace.svg)](https://pypi.org/project/stemtrace/)
 [![CI](https://github.com/iansokolskyi/stemtrace/actions/workflows/ci.yml/badge.svg)](https://github.com/iansokolskyi/stemtrace/actions/workflows/ci.yml)
 [![codecov](https://codecov.io/gh/iansokolskyi/stemtrace/graph/badge.svg)](https://codecov.io/gh/iansokolskyi/stemtrace)

{stemtrace-0.3.4 → stemtrace-0.3.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "stemtrace"
-version = "0.3.4"
+version = "0.3.5"
 description = "A lightweight Celery task flow visualizer"
 readme = "README.md"
 license = { text = "MIT" }

{stemtrace-0.3.4 → stemtrace-0.3.5}/src/stemtrace/__init__.py

@@ -43,7 +43,7 @@ if TYPE_CHECKING:
     from celery import Celery
     from fastapi import FastAPI
 
-__version__ = "0.3.4"
+__version__ = "0.3.5"
 __all__ = [
     "ConfigurationError",
     "StemtraceConfig",

{stemtrace-0.3.4 → stemtrace-0.3.5}/src/stemtrace/server/ui/frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "stemtrace-ui",
   "private": true,
-  "version": "0.3.4",
+  "version": "0.3.5",
   "type": "module",
   "scripts": {
     "dev": "vite",

{stemtrace-0.3.4 → stemtrace-0.3.5}/src/stemtrace/server/ui/static.py

@@ -4,7 +4,9 @@ from __future__ import annotations
 
 import json
 import logging
+import os
 import re
+import stat
 from pathlib import Path
 
 from fastapi import APIRouter, Request
@@ -160,6 +162,46 @@ def _rewrite_html_for_prefix(
     return html.replace("<head>", script)
 
 
+def _contained_frontend_path(path: str) -> str | None:
+    """Confine a request path to the frontend directory, lexically.
+
+    The request path is user-controlled. It is joined onto the resolved
+    frontend directory and normalized as a string (dot-segments collapsed,
+    no symlink resolution), then accepted only if the result is still under
+    that directory. The filesystem is never touched for the candidate before
+    this check passes. Symlinks inside the frontend directory are trusted and
+    followed when the file is served (they come from the installed package,
+    e.g. symlink-mode installs), since only the request path is untrusted.
+
+    Args:
+        path: Path parameter taken from the request URL.
+
+    Returns:
+        The normalized absolute path if it lies under the frontend directory
+        (it may not exist), or None if it escapes the directory.
+    """
+    base = os.path.realpath(_FRONTEND_DIR)
+    candidate = os.path.normpath(Path(base) / path)
+    # Plain string prefix check: an absolute request path, a drive change or
+    # a UNC path (Windows) all produce a candidate outside this prefix.
+    base_prefix = base if base.endswith(os.sep) else base + os.sep
+    if candidate != base and not candidate.startswith(base_prefix):
+        return None
+    return candidate
+
+
+def _is_regular_file(path: str) -> bool:
+    """Return True if path is an existing regular file (symlinks followed).
+
+    Any error while inspecting the path (missing file, name too long,
+    embedded NUL byte, permission denied) is treated as "not a file".
+    """
+    try:
+        return stat.S_ISREG(Path(path).stat().st_mode)
+    except (OSError, ValueError):
+        return False
+
+
 def get_static_router(*, show_logout: bool = False) -> APIRouter | None:
     """Create router for UI static files. Returns None if dist/ missing."""
     return get_static_router_with_base(None, show_logout=show_logout)
@@ -220,9 +262,17 @@ def get_static_router_with_base(
 
     @router.get("/{path:path}", response_model=None)
     async def serve_spa(path: str, request: Request) -> FileResponse | HTMLResponse:
-        """Serve static files or fall back to index.html for SPA routing."""
-        file_path = _FRONTEND_DIR / path
-        if file_path.exists() and file_path.is_file():
+        """Serve static files or fall back to index.html for SPA routing.
+
+        Only regular files under the frontend directory are served. Paths
+        that normalize to a location outside of it get a 404; any other path
+        that is not a servable file (missing, a directory, or not inspectable)
+        falls back to index.html so client-side routes keep working.
+        """
+        file_path = _contained_frontend_path(path)
+        if file_path is None:
+            return HTMLResponse("<h1>Not found</h1>", status_code=404)
+        if _is_regular_file(file_path):
             return FileResponse(file_path)
 
         index_path = _FRONTEND_DIR / "index.html"