security: fix path traversal in StaticFileHandler

[q1uf3ng]

Summary

The custom StaticFileHandler in openhtf/output/servers/web_gui_server.py overrides Tornado's validate_absolute_path() to return the path without any validation, completely removing the built-in path traversal protection.

This allows requests such as GET /img/../../../../etc/passwd to read arbitrary files on the host filesystem.

Fix

• Use os.path.abspath() in get_absolute_path() to resolve ../ sequences
• Check the resolved path starts with the static root directory in validate_absolute_path()
• Return 403 if the path escapes the root, 404 if the file doesn't exist

Reproduction

# With the current code, the following returns /etc/passwd contents:
curl --path-as-is "http://HOST:PORT/img/../../../../../../../../etc/passwd"

# Tornado's default StaticFileHandler correctly returns 403

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.