[Security] Arbitrary File Read via /api/file/content endpoint

[y4sol]

Description

The /api/file/content endpoint in Flocks allows unrestricted file system access without any path validation or authentication. Any user with network access to the Flocks server can read arbitrary files on the system.

Steps to Reproduce

1. Start Flocks server
2. Send GET request to http://127.0.0.1:PORT/api/file/content?path=/etc/passwd
3. File content is returned without authentication

Affected Endpoints

• GET /api/file/content?path=<arbitrary_path>

Impact

• Read SSH private keys: ~/.ssh/id_rsa
• Read API keys from config: ~/.flocks/config/.secret.json
• Read environment variables: /proc/self/environ
• Read any file accessible by the Flocks process user

Suggested Fix

1. Add authentication middleware to all API endpoints
2. Implement path validation to restrict file access to project directories only
3. Add CORS restrictions (currently allow_origins=*)

Environment

• Flocks version: latest
• Server: 127.0.0.1:8000 (backend), 127.0.0.1:5172 (frontend)

[duguwanglong]

Thx. This is an issue, we will fix it in next release.