streamlit-nightly 1.53.2.dev20260131__py3-none-any.whl → 1.53.2.dev20260203__py3-none-any.whl

streamlit/web/server/starlette/starlette_routes.py

@@ -701,7 +701,8 @@ def create_component_routes(
         # Use build_safe_abspath to properly resolve symlinks and prevent traversal
         abspath = build_safe_abspath(component_root, filename)
         if abspath is None:
-            raise HTTPException(status_code=403, detail="Forbidden")
+            # Return 400 for malicious paths (consistent with middleware behavior)
+            raise HTTPException(status_code=400, detail="Bad Request")
 
         try:
             async with await anyio.open_file(abspath, "rb") as file:
@@ -772,7 +773,8 @@ def create_bidi_component_routes(
 
         abspath = build_safe_abspath(component_root, filename)
         if abspath is None:
-            return await _text_response("forbidden", 403)
+            # Return 400 for unsafe paths (matches Tornado behavior for opacity)
+            return await _text_response("Bad Request", 400)
 
         if await AsyncPath(abspath).is_dir():
             return await _text_response("not found", 404)
@@ -838,7 +840,8 @@ def create_app_static_serving_routes(
         relative_path = request.path_params.get("path", "")
         safe_path = build_safe_abspath(app_static_root, relative_path)
         if safe_path is None:
-            raise HTTPException(status_code=404, detail="File not found")
+            # Return 400 for malicious paths (consistent with middleware behavior)
+            raise HTTPException(status_code=400, detail="Bad Request")
 
         async_path = AsyncPath(safe_path)
         if not await async_path.exists() or await async_path.is_dir():

streamlit/web/server/starlette/starlette_static_routes.py

@@ -24,6 +24,7 @@ import os
 from typing import TYPE_CHECKING, Any, Final
 
 from streamlit import file_util
+from streamlit.path_security import is_unsafe_path_pattern
 from streamlit.url_util import make_url_path
 from streamlit.web.server.routes import (
     NO_CACHE_PATTERN,
@@ -51,7 +52,7 @@ def create_streamlit_static_handler(
     - Long-term caching of hashed assets
     - No-cache for HTML/manifest files
     - Trailing slash redirect (301)
-    - Double-slash protection (403 for protocol-relative URL security)
+    - Double-slash protection (400 for protocol-relative URL security)
     """
     from starlette.exceptions import HTTPException
     from starlette.responses import FileResponse, RedirectResponse, Response
@@ -74,10 +75,19 @@ def create_streamlit_static_handler(
             # Security check: Block paths starting with double slash (protocol-relative
             # URL protection). A path like //example.com could be misinterpreted as a
             # protocol-relative URL if redirected, which is a security risk.
-            # This matches Tornado's behavior where such paths would escape the static
-            # directory and trigger a 403 Forbidden.
             if path.startswith("//"):
-                response = Response(content="Forbidden", status_code=403)
+                response = Response(content="Bad Request", status_code=400)
+                await response(scope, receive, send)
+                return
+
+            # Security check: Block UNC paths, absolute paths, drive-qualified paths,
+            # and path traversal patterns BEFORE any filesystem operations.
+            # See is_unsafe_path_pattern() docstring for details.
+            # Strip the leading slash since paths come in as "/filename" but we check
+            # the relative portion.
+            relative_path = path.lstrip("/")
+            if relative_path and is_unsafe_path_pattern(relative_path):
+                response = Response(content="Bad Request", status_code=400)
                 await response(scope, receive, send)
                 return
 

{streamlit_nightly-1.53.2.dev20260131.dist-info → streamlit_nightly-1.53.2.dev20260203.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: streamlit-nightly
-Version: 1.53.2.dev20260131
+Version: 1.53.2.dev20260203
 Summary: A faster way to build and share data apps
 Author-email: Snowflake Inc <hello@streamlit.io>
 License-Expression: Apache-2.0