security: sanitize fetch parameter in /download endpoint using secure_filename (fixes #358)

[GaneshPatil7517]

Hello pradeeban Sir,

Fixes #358.

This PR improves validation of the fetch parameter in the /download endpoint.

Previously, dir and fetchDir were sanitized, but the fetch value (used as the filename) was passed directly to send_from_directory() without sanitization. This meant a request like:

fetch=../../etc/passwd

could attempt directory traversal.

This change applies secure_filename() to the requested filename before it is used. It also adds a small check to ensure the filename is not empty after sanitization.

Changes in this PR:

• Applied secure_filename() to download_file
• Added validation to reject missing or empty filenames
• Kept the existing endpoint logic and security checks unchanged

Security impact:

• Prevents directory traversal attempts through the fetch parameter
• Restricts filenames to safe patterns (e.g. ../../etc/passwd becomes etc_passwd)
• Blocks empty or invalid filenames with a 400 response

Scope:

• Single file modified: fri/server/main.py
• No changes to concore-lite
• No changes to Verilog code
• No behavior change for valid requests

Testing done locally:

• Normal downloads such as fetch=example.txt still work
• Traversal attempts like fetch=../../etc/passwd are sanitized
• Empty or invalid filenames return HTTP 400
• No regressions observed in directory handling

Please review. Thank you.

[Copilot]

Pull request overview

This PR addresses a security vulnerability (Issue #358) in the /download endpoint by applying secure_filename() sanitization to the fetch parameter, which was previously passed unsanitized to send_from_directory(). This prevented potential path traversal attacks where malicious users could access files outside the intended directory.

Changes:

• Applied secure_filename() to sanitize the download_file parameter (derived from fetch)
• Added validation to reject empty filenames after sanitization
• Maintained existing security checks for defense-in-depth

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.