Resolve *relative_path* under the static root; reject traversal.
(relative_path: str)
| 45 | |
| 46 | |
| 47 | def _safe_static_file(relative_path: str) -> Path: |
| 48 | """Resolve *relative_path* under the static root; reject traversal.""" |
| 49 | root = _static_root() |
| 50 | candidate = (root / relative_path).resolve() |
| 51 | if not is_path_under_static(candidate, root): |
| 52 | raise HTTPException(status_code=403, detail="Access denied") |
| 53 | return candidate |
| 54 | |
| 55 | |
| 56 | def is_path_under_static(path: Path, root: Path) -> bool: |
no test coverage detected