From c5a64bb6fd59ef5712e1e1ee3896c0e54b740f84 Mon Sep 17 00:00:00 2001
From: Gamosoft <gamosoft@users.noreply.github.com>
Date: Fri, 13 Mar 2026 11:58:45 +0100
Subject: [PATCH] security fixes

---
 backend/main.py   | 11 +++++++++++
 backend/themes.py | 14 +++++++++++++-
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/backend/main.py b/backend/main.py
index e327bfe..339547f 100644
--- a/backend/main.py
+++ b/backend/main.py
@@ -536,9 +536,20 @@ async def get_available_locales():
 async def get_locale(locale_code: str):
     """Get translations for a specific locale"""
     import json
+    import re
+    
+    # Security: Validate locale_code to prevent path traversal
+    # Only allow alphanumeric, hyphens, and underscores (e.g., "en", "pt-BR", "zh_CN")
+    if not re.match(r'^[a-zA-Z0-9_-]+$', locale_code):
+        raise HTTPException(status_code=400, detail="Invalid locale code")
+    
     locales_dir = Path(__file__).parent.parent / "locales"
     locale_file = locales_dir / f"{locale_code}.json"
     
+    # Security: Ensure resolved path is still within locales directory
+    if not locale_file.resolve().is_relative_to(locales_dir.resolve()):
+        raise HTTPException(status_code=400, detail="Invalid locale code")
+    
     if not locale_file.exists():
         raise HTTPException(status_code=404, detail="Locale not found")
     
diff --git a/backend/themes.py b/backend/themes.py
index 6741292..b468d99 100644
--- a/backend/themes.py
+++ b/backend/themes.py
@@ -73,7 +73,19 @@ def get_available_themes(themes_dir: str) -> List[Dict[str, str]]:
 
 def get_theme_css(themes_dir: str, theme_id: str) -> str:
     """Get the CSS content for a specific theme"""
-    theme_path = Path(themes_dir) / f"{theme_id}.css"
+    import re
+    
+    # Security: Validate theme_id to prevent path traversal
+    # Only allow alphanumeric, hyphens, and underscores
+    if not re.match(r'^[a-zA-Z0-9_-]+$', theme_id):
+        return ""
+    
+    themes_path = Path(themes_dir)
+    theme_path = themes_path / f"{theme_id}.css"
+    
+    # Security: Ensure resolved path is still within themes directory
+    if not theme_path.resolve().is_relative_to(themes_path.resolve()):
+        return ""
     
     if not theme_path.exists():
         return ""