Fastapi parameter validation

.github/workflows/pytest.yaml

@@ -23,6 +23,14 @@ jobs:
       - name: Install fastapi ${{ matrix.fastapi-version }}
         run: poetry add fastapi@^${{ matrix.fastapi-version}}
         working-directory: ${{ env.BACKEND_DIR }}
+      - uses: ./.github/actions/pnpm-node-install
+        name: Install Node, pnpm and dependencies.
+        with:
+          node-version: 22.7.0
+          pnpm-version: 9.7.0
+          pnpm-install-args: --no-frozen-lockfile
+      - name: Build UI
+        run: pnpm run buildUi
       - name: Run Pytest
         run: poetry run pytest --cov=chainlit/
         working-directory: ${{ env.BACKEND_DIR }}

backend/chainlit/_utils.py

@@ -0,0 +1,8 @@
+"""Util functions which are explicitly not part of the public API."""
+
+from pathlib import Path
+
+
+def is_path_inside(child_path: Path, parent_path: Path) -> bool:
+    """Check if the child path is inside the parent path."""
+    return parent_path.resolve() in child_path.resolve().parents

backend/chainlit/config.py

@@ -24,6 +24,8 @@
 from pydantic.dataclasses import Field, dataclass
 from starlette.datastructures import Headers
 
+from ._utils import is_path_inside
+
 if TYPE_CHECKING:
     from chainlit.action import Action
     from chainlit.element import ElementBased
@@ -343,33 +345,41 @@ def load_translation(self, language: str):
         # fallback to root language (ex: `de` when `de-DE` is not found)
         parent_language = language.split("-")[0]
 
-        translation_lib_file_path = os.path.join(
-            config_translation_dir, f"{language}.json"
-        )
-        translation_lib_parent_language_file_path = os.path.join(
-            config_translation_dir, f"{parent_language}.json"
-        )
-        default_translation_lib_file_path = os.path.join(
-            config_translation_dir, f"{default_language}.json"
-        )
+        translation_dir = Path(config_translation_dir)
 
-        if os.path.exists(translation_lib_file_path):
-            with open(translation_lib_file_path, "r", encoding="utf-8") as f:
-                translation = json.load(f)
-        elif os.path.exists(translation_lib_parent_language_file_path):
+        translation_lib_file_path = translation_dir / f"{language}.json"
+        translation_lib_parent_language_file_path = (
+            translation_dir / f"{parent_language}.json"
+        )
+        default_translation_lib_file_path = translation_dir / f"{default_language}.json"
+
+        if (
+            is_path_inside(translation_lib_file_path, translation_dir)
+            and translation_lib_file_path.is_file()
+        ):
+            translation = json.loads(
+                translation_lib_file_path.read_text(encoding="utf-8")
+            )
+        elif (
+            is_path_inside(translation_lib_parent_language_file_path, translation_dir)
+            and translation_lib_parent_language_file_path.is_file()
+        ):
             logger.warning(
                 f"Translation file for {language} not found. Using parent translation {parent_language}."
             )
-            with open(
-                translation_lib_parent_language_file_path, "r", encoding="utf-8"
-            ) as f:
-                translation = json.load(f)
-        elif os.path.exists(default_translation_lib_file_path):
+            translation = json.loads(
+                translation_lib_parent_language_file_path.read_text(encoding="utf-8")
+            )
+        elif (
+            is_path_inside(default_translation_lib_file_path, translation_dir)
+            and default_translation_lib_file_path.is_file()
+        ):
             logger.warning(
                 f"Translation file for {language} not found. Using default translation {default_language}."
             )
-            with open(default_translation_lib_file_path, "r", encoding="utf-8") as f:
-                translation = json.load(f)
+            translation = json.loads(
+                default_translation_lib_file_path.read_text(encoding="utf-8")
+            )
 
         return translation
 

backend/chainlit/markdown.py

@@ -1,7 +1,11 @@
 import os
+from pathlib import Path
+from typing import Optional
 
 from chainlit.logger import logger
 
+from ._utils import is_path_inside
+
 # Default chainlit.md file created if none exists
 DEFAULT_MARKDOWN_STR = """# Welcome to Chainlit! 🚀🤖
 
@@ -30,22 +34,24 @@ def init_markdown(root: str):
             logger.info(f"Created default chainlit markdown file at {chainlit_md_file}")
 
 
-def get_markdown_str(root: str, language: str):
+def get_markdown_str(root: str, language: str) -> Optional[str]:
     """Get the chainlit.md file as a string."""
-    translated_chainlit_md_path = os.path.join(root, f"chainlit_{language}.md")
-    default_chainlit_md_path = os.path.join(root, "chainlit.md")
-
-    if os.path.exists(translated_chainlit_md_path):
+    root_path = Path(root)
+    translated_chainlit_md_path = root_path / f"chainlit_{language}.md"
+    default_chainlit_md_path = root_path / "chainlit.md"
+
+    if (
+        is_path_inside(translated_chainlit_md_path, root_path)
+        and translated_chainlit_md_path.is_file()
+    ):
         chainlit_md_path = translated_chainlit_md_path
     else:
         chainlit_md_path = default_chainlit_md_path
         logger.warning(
             f"Translated markdown file for {language} not found. Defaulting to chainlit.md."
         )
 
-    if os.path.exists(chainlit_md_path):
-        with open(chainlit_md_path, "r", encoding="utf-8") as f:
-            chainlit_md = f.read()
-            return chainlit_md
+    if chainlit_md_path.is_file():
+        return chainlit_md_path.read_text(encoding="utf-8")
     else:
         return None