Prevent arbitrary file read via path traversal

Author: lukicdarkoo

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "teleop"
-version = "0.1.3"
+version = "0.1.4"
 description = "Turns your phone into a robot arm teleoperation device by leveraging the WebXR API"
 readme = { file = "README.md", content-type = "text/markdown" }
 license = { file = "LICENSE" }
@@ -31,4 +31,4 @@ utils = ["pin"]
 include = ["teleop*"]
 
 [tool.setuptools.package-data]
-teleop = ["cert.pem", "key.pem", "index.html", "teleop-ui.js", "utils/lite6.urdf"]
+teleop = ["cert.pem", "key.pem", "index.html", "assets/*", "utils/lite6.urdf"]

teleop/__init__.py

@@ -6,6 +6,7 @@
 import uvicorn
 from fastapi import FastAPI, WebSocket, WebSocketDisconnect
 from fastapi.responses import FileResponse
+from fastapi.staticfiles import StaticFiles
 import transforms3d as t3d
 import numpy as np
 import json
@@ -278,19 +279,15 @@ def __update(self, message):
         self.__notify_subscribers(self.__pose, message)
 
     def __setup_routes(self):
+        # Mount static files directory
+        assets_dir = os.path.join(THIS_DIR, "assets")
+        self.__app.mount("/assets", StaticFiles(directory=assets_dir), name="assets")
+
         @self.__app.get("/")
         async def index():
             self.__logger.debug("Serving the index.html file")
             return FileResponse(os.path.join(THIS_DIR, "index.html"))
 
-        @self.__app.get("/{filename:path}")
-        async def serve_file(filename: str):
-            self.__logger.debug(f"Serving the {filename} file")
-            file_path = os.path.join(THIS_DIR, filename)
-            if os.path.exists(file_path):
-                return FileResponse(file_path)
-            return {"error": "File not found"}
-
         @self.__app.websocket("/ws")
         async def websocket_endpoint(websocket: WebSocket):
             await self.__manager.connect(websocket)

teleop/teleop-ui.js teleop/assets/teleop-ui.jsteleop/teleop-ui.js renamed to teleop/assets/teleop-ui.js

@@ -5,7 +5,7 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>Teleop</title>
-    <script src="teleop-ui.js"></script>
+    <script src="/assets/teleop-ui.js"></script>
 
     <style>
         * {

teleop/index.html

@@ -5,7 +5,7 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>Teleop</title>
-    <script src="teleop-ui.js"></script>
+    <script src="/assets/teleop-ui.js"></script>
     <style>
         * {
             margin: 0;