Potential fix for pull request finding 'CodeQL / Uncontrolled data used in path expression'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Author: Zayadul-huq-afnan

server/serve_accessibility_report.py

@@ -3,12 +3,14 @@
 """
 
 from pathlib import Path
+import re
 from fastapi import APIRouter, HTTPException
 from fastapi.responses import FileResponse
 from urllib.parse import unquote
 
 router = APIRouter(prefix="/debug/reports", tags=["debug-reports"])
 REPORTS_BASE_DIR = Path("reports/accessibility").resolve()
+SAFE_REPORT_FILENAME_RE = re.compile(r"^[A-Za-z0-9._-]+\.html$")
 
 
 @router.get("/accessibility")
@@ -17,18 +19,31 @@ def serve_accessibility_report(file_path: str):
     try:
         # Decode URL-encoded path
         print("Serving accessi file")
-        decoded_path = unquote(file_path)
-        requested_path = Path(decoded_path)
+        decoded_path = unquote(file_path).strip()
 
-        # Reject absolute paths and traversal attempts before joining
-        if requested_path.is_absolute() or ".." in requested_path.parts:
+        # Accept only a safe filename (no directory components)
+        if not decoded_path:
+            raise HTTPException(
+                status_code=400,
+                detail="Invalid report path"
+            )
+
+        # Reject any path separators or dot-directory tokens
+        if "/" in decoded_path or "\\" in decoded_path or decoded_path in {".", ".."}:
+            raise HTTPException(
+                status_code=400,
+                detail="Invalid report path"
+            )
+
+        # Ensure it is a basename and matches allowed characters + .html extension
+        if Path(decoded_path).name != decoded_path or not SAFE_REPORT_FILENAME_RE.match(decoded_path):
             raise HTTPException(
                 status_code=400,
                 detail="Invalid report path"
             )
 
         # Resolve path under a fixed reports directory to prevent traversal
-        html_file = (REPORTS_BASE_DIR / requested_path).resolve()
+        html_file = (REPORTS_BASE_DIR / decoded_path).resolve()
         try:
             html_file.relative_to(REPORTS_BASE_DIR)
         except ValueError: