Potential fix for code scanning alert no. 107: Uncontrolled data used in path expression

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

backend/api/images.py

@@ -1048,12 +1048,21 @@ async def serve_image_studio_image(
             raise HTTPException(status_code=403, detail="Access denied: image not found in your library")
         
         # Determine if it's an edited image or regular image
+        # Validate user-controlled path input before filesystem path construction
+        image_filename_path = Path(image_filename)
+        if image_filename_path.is_absolute() or any(part in ("", ".", "..") for part in image_filename_path.parts):
+            raise HTTPException(status_code=403, detail="Access denied: Invalid image path")
+
         base_dir = Path(__file__).parent.parent
         image_studio_dir = (base_dir / "image_studio_images").resolve()
         
         if image_filename.startswith("edited/"):
             # Remove "edited/" prefix and serve from edited directory
             actual_filename = image_filename.replace("edited/", "", 1)
+            actual_filename_path = Path(actual_filename)
+            if actual_filename_path.is_absolute() or any(part in ("", ".", "..") for part in actual_filename_path.parts):
+                raise HTTPException(status_code=403, detail="Access denied: Invalid image path")
+
             image_path = (image_studio_dir / "edited" / actual_filename).resolve()
             base_subdir = (image_studio_dir / "edited").resolve()
         else:

backend/routers/video_studio/endpoints/serve.py

@@ -40,25 +40,29 @@ async def serve_video_studio_video(
         video_studio_videos_dir = base_dir / "video_studio_videos"
         video_path = video_studio_videos_dir / user_id / video_filename
         
-        # Security: Resolve and ensure path is within video_studio_videos directory
+        # Security: Ensure path is within video_studio_videos directory
         try:
-            resolved_base = video_studio_videos_dir.resolve()
             resolved_path = video_path.resolve()
-            resolved_path.relative_to(resolved_base)
+            resolved_base = video_studio_videos_dir.resolve()
+            if not str(resolved_path).startswith(str(resolved_base)):
+                raise HTTPException(
+                    status_code=403,
+                    detail="Invalid video path"
+                )
         except (OSError, ValueError) as e:
             logger.error(f"[VideoStudio] Path resolution error: {e}")
             raise HTTPException(status_code=403, detail="Invalid video path")
         
         # Check if file exists
-        if not resolved_path.exists() or not resolved_path.is_file():
+        if not video_path.exists() or not video_path.is_file():
             raise HTTPException(
                 status_code=404,
                 detail=f"Video not found: {video_filename}"
             )
         
-        logger.info(f"[VideoStudio] Serving video: {resolved_path}")
+        logger.info(f"[VideoStudio] Serving video: {video_path}")
         return FileResponse(
-            path=str(resolved_path),
+            path=str(video_path),
             media_type="video/mp4",
             filename=video_filename,
         )