fix: Information Disclosure - Path Traversal Security Vulnerability#178
Merged
Roopan-Microsoft merged 5 commits intomainfrom Apr 8, 2026
Merged
fix: Information Disclosure - Path Traversal Security Vulnerability#178Roopan-Microsoft merged 5 commits intomainfrom
Roopan-Microsoft merged 5 commits intomainfrom
Conversation
chore: Down merge from main to dev
…112301] - Use os.path.realpath() to resolve symlinks and '..' sequences, then verify the resolved path stays within BUILD_DIR before serving files. - Replace os.path.exists() with os.path.isfile() to prevent directory listing. - Replace allow_origins=['*'] CORS wildcard with configurable ALLOWED_ORIGINS env var (empty = same-origin only). - Restrict CORS allow_methods to GET. - Add origin-vs-host check on /config to block cross-origin reads. - Remove verbose fallback strings from /config defaults that disclosed deployment state. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add ALLOWED_ORIGINS to both main.bicep and main_custom.bicep so the frontend CORS policy is automatically configured with the container app's own FQDN during Azure deployment. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…-112301 fix: patch path traversal (CWE-22) and harden /config endpoint [MSRC 112301]
Prajwal-Microsoft
requested review from
Avijit-Microsoft,
Dongbumlee,
Roopan-Microsoft,
Vinay-Microsoft,
aniaroramsft,
dgp10801,
nchandhi,
sethsteenken and
toherman-msft
as code owners
Prajwal-Microsoft
temporarily deployed
to
production
GitHub Actions
Inactive
Roopan-Microsoft
approved these changes
Apr 8, 2026
|
🎉 This PR is included in version 1.0.4 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Frontend server security and configuration:
ALLOWED_ORIGINSenvironment variable, replacing the previous open policy (*). OnlyGETmethods are allowed, reducing the attack surface./configendpoint now checks the request'sOriginandHostheaders, serving configuration only to same-origin requests and returning 403 Forbidden otherwise. This prevents leaking sensitive configuration to third-party sites.Infrastructure and environment configuration:
ALLOWED_ORIGINSenvironment variable is now set in bothinfra/main.bicepandinfra/main_custom.bicep, using the frontend container app name and environment domain to dynamically generate the allowed origin. [1] [2]infra/main.json) is updated to include the newALLOWED_ORIGINSenvironment variable for the frontend container app, and minor dependency ordering adjustments are made for private DNS zones to ensure correct resource deployment. [1] [2] [3] [4]Does this introduce a breaking change?
Golden Path Validation
Deployment Validation
What to Check
Verify that the following are valid
Other Information