fix: validate socket session id

QV
22d ago
+72-1

fixes the following security report: https://security.snyk.io/vuln/SNYK-PYTHON-CHAINLIT-19659988

Summary by cubic

Fixes a path traversal vulnerability (SNYK-PYTHON-CHAINLIT-19659988) where a client-supplied session ID could escape the session files directory and delete arbitrary paths.

  • Session IDs are now validated against a strict pattern ([A-Za-z0-9_-]{1,128}) before use.
  • Websocket connections with invalid or missing session IDs are refused at connect time, and accessing files_dir with an invalid ID raises a ValueError.