Patched code sample

import pathlib
import os

class App:
    """
    This is a simplified, conceptual representation of the NiceGUI App class
    to demonstrate how a directory traversal vulnerability can be fixed.
    """
    def __init__(self):
        # In a real application, this would be the root directory for media files.
        # .resolve() is used to get the canonical absolute path of the directory.
        self.media_root = pathlib.Path('nicegui_media_root').resolve()
        # For demonstration, ensure the base directory exists.
        self.media_root.mkdir(exist_ok=True)

    def add_media_files(self, url_path: str, local_folder_from_user: str) -> None:
        """
        A conceptual, fixed version of the vulnerable add_media_files function.

        This version prevents directory traversal by ensuring the resolved
        file path is safely within the intended media root directory before
        it is used.
        """
        # Step 1: Resolve the path provided by the user against the media root.
        # The `resolve()` method is critical as it canonicalizes the path,
        # processing any '..' components and symbolic links.
        # A vulnerable implementation might just use os.path.join() without resolving.
        try:
            requested_path = (self.media_root / local_folder_from_user).resolve()
        except FileNotFoundError:
            # If the base path doesn't exist, we can't serve it. This is a
            # standard error, not a security flaw in itself.
            # In a real app, this might log an error or simply do nothing.
            return

        # Step 2: THE FIX - Check if the resolved path is within the allowed media root.
        # This is the core of the directory traversal prevention. It ensures
        # that the resulting path has not "escaped" the intended parent directory.
        # For Python 3.9+, one could use: `requested_path.is_relative_to(self.media_root)`
        # The method below is compatible with older Python versions.
        common_path = os.path.commonpath([self.media_root, requested_path])

        if str(self.media_root) != common_path:
            # If the longest common path is not the media root itself, it means the
            # user-provided path has traversed outside the allowed directory.
            raise PermissionError(
                f"Directory traversal attempt blocked. The path '{local_folder_from_user}' "
                "resolves outside the allowed media directory."
            )

        # Step 3: If the check passes, the application can safely proceed.
        # The original logic to register the path for serving would go here.
        # For example: self._register_media_route(url_path, requested_path)
        pass