security fixes

backend/main.py

@@ -536,9 +536,20 @@ async def get_available_locales():
 async def get_locale(locale_code: str):
     """Get translations for a specific locale"""
     import json
+    import re
+    
+    # Security: Validate locale_code to prevent path traversal
+    # Only allow alphanumeric, hyphens, and underscores (e.g., "en", "pt-BR", "zh_CN")
+    if not re.match(r'^[a-zA-Z0-9_-]+$', locale_code):
+        raise HTTPException(status_code=400, detail="Invalid locale code")
+    
     locales_dir = Path(__file__).parent.parent / "locales"
     locale_file = locales_dir / f"{locale_code}.json"
     
+    # Security: Ensure resolved path is still within locales directory
+    if not locale_file.resolve().is_relative_to(locales_dir.resolve()):
+        raise HTTPException(status_code=400, detail="Invalid locale code")
+    
     if not locale_file.exists():
         raise HTTPException(status_code=404, detail="Locale not found")
     

backend/themes.py

@@ -73,7 +73,19 @@ def get_available_themes(themes_dir: str) -> List[Dict[str, str]]:
 
 def get_theme_css(themes_dir: str, theme_id: str) -> str:
     """Get the CSS content for a specific theme"""
-    theme_path = Path(themes_dir) / f"{theme_id}.css"
+    import re
+    
+    # Security: Validate theme_id to prevent path traversal
+    # Only allow alphanumeric, hyphens, and underscores
+    if not re.match(r'^[a-zA-Z0-9_-]+$', theme_id):
+        return ""
+    
+    themes_path = Path(themes_dir)
+    theme_path = themes_path / f"{theme_id}.css"
+    
+    # Security: Ensure resolved path is still within themes directory
+    if not theme_path.resolve().is_relative_to(themes_path.resolve()):
+        return ""
     
     if not theme_path.exists():
         return ""