Lukas 94bdabe622 TASK-016: Validate delete_log_path query parameter with allowlist ...

- Extract path validation logic into shared helper function in
  backend/app/utils/path_utils.py (validate_log_path)
- Refactor AddLogPathRequest to use the helper function
- Apply the same validation to DELETE /api/config/jails/{name}/logpath
  endpoint by validating the log_path query parameter
- Return HTTP 422 with descriptive error if validation fails
- Add comprehensive unit tests for path validation
- Update Backend-Development.md with usage examples

This prevents path-traversal attacks on the delete_log_path endpoint
by ensuring all log paths are within allowlisted directories.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

2026-04-26 14:04:21 +02:00

..

__init__.py

feat: Stage 1 — backend and frontend scaffolding

2026-02-28 21:15:01 +01:00

async_utils.py

Use shared blocking executor in run_blocking

2026-04-14 12:07:35 +02:00

client_ip.py

Implement login endpoint rate limiting (TASK-007)

2026-04-26 12:40:52 +02:00

conffile_parser.py

Move conffile_parser from services to utils

2026-03-22 14:24:24 +01:00

config_file_utils.py

Refactor backend services and utilities

2026-04-25 18:39:30 +02:00

config_parser.py

Standardize async offloading behind shared executor helper

2026-04-11 20:40:08 +02:00

config_writer.py

feat: config file parser + writer utilities with full test coverage (Tasks 4.1, 4.2)

2026-03-13 19:38:03 +01:00

constants.py

Fix: Consolidate divergent _since_unix implementations (T-09)

2026-04-25 18:44:59 +02:00

fail2ban_client.py

Move Fail2Ban exceptions into central app.exceptions module

2026-04-15 10:22:48 +02:00

fail2ban_db_utils.py

Refactor fail2ban DB path lookup and simplify geo router response

2026-04-15 09:15:50 +02:00

fail2ban_response.py

refactor: Extract fail2ban response utilities into shared module

2026-04-23 15:11:21 +02:00

ip_utils.py

TASK-009: Mitigate SSRF vulnerability in blocklist URL validation

2026-04-26 12:57:23 +02:00

jail_config.py

Fix blocklist-import bantime, unify filter bar, and improve config navigation

2026-03-17 11:31:46 +01:00

jail_socket.py

Refactor backend services and jail configuration

2026-04-25 18:34:03 +02:00

path_utils.py

TASK-016: Validate delete_log_path query parameter with allowlist

2026-04-26 14:04:21 +02:00

rate_limiter.py

Implement login endpoint rate limiting (TASK-007)

2026-04-26 12:40:52 +02:00

runtime_state.py

TASK-003: Document process-local constraint for RuntimeState and SessionCache

2026-04-26 11:43:34 +02:00

session_cache.py

TASK-003: Document process-local constraint for RuntimeState and SessionCache

2026-04-26 11:43:34 +02:00

setup_state.py

Move runtime application state into a dedicated runtime state manager

2026-04-10 19:07:35 +02:00

setup_utils.py

Remove repository import from setup_utils and move password-hash helper to setup service

2026-04-17 15:38:41 +02:00

time_utils.py

Fix: Consolidate divergent _since_unix implementations (T-09)

2026-04-25 18:44:59 +02:00