feat: rework to FastAPI

[kharkevich]

BREAKING CHANGE: rework api structure, move some validation to FastAPI side

To fix the issue, we need to ensure that filename cannot be used to traverse outside the intended UI directory (ui_dir_path). The best way in this context is to normalize the full candidate path (using os.path.normpath or .resolve()), and then verify that the resulting absolute path starts with the expected root directory (ui_dir_path). Additionally, do not serve files if they are symlinks pointing outside this directory. The recommended approach is to check str(requested_path).startswith(str(ui_dir_path)) after normalizing the path. Update the route handler for /[{filename:path}] (lines 58–73): after constructing requested_path, add a check that validates the normalized absolute path starts with ui_dir_path, denying access otherwise. Edit only this function in mlflow_oidc_auth/routers/ui.py.

You will need to import os (for os.path.commonpath for a more robust check), if not already present, and possibly use string representations to avoid ambiguity.

The optimal way to fix this error is to sanitize and validate the user-controlled filename path parameter before using it. To do this:

• Normalize the incoming filename before joining with the directory, using os.path.normpath (for strings) or Path(filename).name (for single files).
• Reject absolute paths and prevent attempts to escape from the UI directory.
• Construct the requested path by joining the base path and normalized filename, and resolving the final path.
• Explicitly check the input for absolute paths and .. that escape UI directory, and raise an HTTP error (rather than serving index.html) if validation fails, to avoid silent failures and to surface security problems.
• Use is_relative_to as an additional check after resolution.

You should make these changes in the serve_spa method, at line 59 and onward. You will also need to import (or use) os.path if you want to use its utilities, but since the project already uses pathlib, you can entirely stick with Path.

---

To comprehensively prevent path traversal and ensure the file served by the route is within the intended ui_dir_path, normalize the constructed file path (using .resolve()), and then perform a robust check that the resolved path is actually a descendant of ui_dir_path. For broad compatibility and reduced risk of edge case bypass, use a try/except block with requested_path.relative_to(ui_dir_path) to ensure the path is within the root, or, alternatively, compare string representations to verify the root prefix. If the requested file does not reside within ui_dir_path, serve the index.html as a fallback as before (or optionally raise an error).

Only the function at line 59–73 (serve_spa) needs to be updated. No new imports are needed, but a compatible and robust path check must be implemented to replace is_relative_to (for portability and clarity).

---

[sonarqubecloud]

Quality Gate failed

Failed conditions
70.4% Coverage on New Code (required ≥ 80%)
C Reliability Rating on New Code (required ≥ A)
B Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE