[security] Sanitize user-supplied path parameters to prevent path traversal attacks

[GaneshPatil7517]

Summary

Multiple API routes construct filesystem paths directly from user-supplied query parameters (casename, caserunname, file, dataJson) with zero validation or sanitization. An attacker can supply payloads like ../../etc/passwd or ....\Windows\System32\config\SAM to read or overwrite arbitrary files on the server. Additionally, UploadRoute.py calls zf.extractall() on user-uploaded ZIP files without checking entry paths, making it vulnerable to Zip Slip attacks.

Affected routes:

• CaseRoute.py — copyCase, deleteCase, updateData use casename directly in Path() construction
• DataFileRoute.py — downloadFile, downloadCSVFile, downloadResultsFile use file/caserunname in send_file()
• UploadRoute.py — zf.extractall() on user-uploaded ZIPs

Expected behavior

• A shared validation utility in Classes/Base/ should reject any path component containing .., /, , or null bytes
• After resolving the final path, the utility should verify it is within DATA_STORAGE
• All endpoints accepting user-supplied file/case names must call this validator before any filesystem operation
• ZIP extraction should validate each entry's destination path before writing
• Invalid inputs should return HTTP 400 with a clear JSON error message - never a 500

Reproduction steps

1. Start the app: cd API && python app.py
2. Send a request to the copy case endpoint with a traversal payload:

POST /case/copyCase
Content-Type: application/json
{"casename": "../../etc/passwd", "newcasename": "stolen"}

3. Observe that the server attempts to copy from outside DataStorage/
4. Send a download request with a traversal payload:
   GET /dataFile/downloadFile?file=../../API/app.py&casename=test
5. Observe that the server returns the contents of app.py (or any other file on the system)
6. Upload a ZIP file containing an entry with path ../../../malicious.py and observe it gets extracted outside DataStorage/

Environment

• OS: Windows 11 / Ubuntu 22.04 / macOS (all affected)
• Python: 3.10+
• Branch: main
• Files: API/Routes/Case/CaseRoute.py, API/Routes/DataFile/DataFileRoute.py, API/Routes/Upload/UploadRoute.py

Logs or screenshots

# CaseRoute.py — no validation on casename
casename = request.json['casename']
path = Path(Config.DATA_STORAGE, casename)  # attacker controls casename

# DataFileRoute.py — user-controlled path passed to send_file
file = request.args.get('file')
return send_file(Path(Config.DATA_STORAGE, casename, file))

# UploadRoute.py — no Zip Slip protection
zf.extractall(upload_dir)  # entries could contain ../../../

[GaneshPatil7517]

hello @SeaCelo the PR is ready to review can you please review this: #116

[SeaCelo]

This was about path traversal in the route handlers. PR #422 added validate_path() in Config.py and wired it into all the routes that handle user-supplied paths. Also opened an upstream issue (OSeMOSYS/MUIO#53) proposing a cleaner long-term fix. Closing this one.