security: fix unauthenticated file-read and path-traversal file-write in Flask server

[hoanghai2110-web]

Summary

Fix missing path validation in two Flask endpoints in server.py.

Bug A — /api/v1/read_text_file

Before: user-supplied path passed directly to open() with no validation.

After: resolve path with os.path.realpath(), then enforce an allowlist — only paths inside the user home directory or system temp directory are permitted. Return HTTP 403 otherwise.

real = os.path.realpath(os.path.expanduser(path))
allowed_roots = [
    os.path.realpath(os.path.expanduser('~')),
    os.path.realpath(tempfile.gettempdir()),
]
if not any(real == root or real.startswith(root + os.sep) for root in allowed_roots):
    return _make_json_response({'error': 'access denied'}), 403

Bug B — /apipost/v1/upload

Before: raw f.filename joined with os.path.join() — ../ sequences not stripped (Werkzeug docs explicitly warn to use secure_filename() before using a user-supplied filename).

After: sanitise with secure_filename(), then verify the resolved path stays inside tmp_dir before saving.

file_name = secure_filename(f.filename or 'no_name') or 'upload'
file_path = os.path.join(tmp_dir, file_name)
if not os.path.realpath(file_path).startswith(os.path.realpath(tmp_dir) + os.sep):
    return _make_json_response({'error': 'invalid filename'}), 400
f.save(file_path)