Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion mxcubeweb/core/adapter/detector_adapter.py
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ def _state_change(self, *args, **kwargs):
def state(self):
return self._ho.get_state().name.upper()

def display_image(self, path: str, img_num) -> dict:
def display_image(self, path: str, img_num: int) -> dict:
"""Notify ADXV and/or Braggy of the image to display."""
res = {"image_url": ""}

Expand Down
7 changes: 5 additions & 2 deletions mxcubeweb/core/server/resource_handler.py
Original file line number Diff line number Diff line change
Expand Up @@ -28,15 +28,18 @@ def valid_object_id(object_id: str) -> bool:


def validate_input_str(input_string: str) -> bool:
"""Validate that input string contains only alphanumeric characters and/or dot (.).
"""Validate input string.

Ensure that input string contains only alphanumeric characters and/or
posix path characters such as dot (.), backslash (/) and dash (-).

Args:
input_string (str): The string to validate.

Returns:
bool: True if the string is valid, False otherwise.
"""
pattern = r"^[a-zA-Z0-9._]*$"
pattern = r"^[a-zA-Z0-9._/-]*$"
Copy link
Member

@marcus-oscarsson marcus-oscarsson Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have a doubt about /, where do you need that, I imagine for a path ?

We should perhaps have a specific validation made for paths, to avoid i.e ../../ and other sort of possibly "nasty" things ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The display_image(self, path: str, img_num: int) function expects a path to the images masterfile and the validator blocks it. I also think that it should be a different type of validation for this specific type, how do you propose to include this custom type?

return bool(re.match(pattern, input_string))


Expand Down
2 changes: 1 addition & 1 deletion ui/src/actions/general.js
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ export function displayImage(path, imgNum) {
'detector',
'detector',
'display_image',
{ path, imgNum },
{ path, img_num: imgNum },
);
window.open(data.image_url, 'braggy');
};
Expand Down
Loading