/health returns local filesystem paths
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 94
- Forks
- 16
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 5
Description
Summary
GET /health is unauthenticated and returns:
page_path— absolute path topage.htmlpage_candidates— the full search list of local paths
That is local filesystem layout, including home-directory prefixes. Architecture says public HTTP should not carry local paths.
page_path is currently used by scripts/install / install-linux to confirm the process on :8722 is this runtime (os.path.commonpath). So any change needs an installer-compatible substitute (for example a fingerprint of the runtime root) rather than just deleting the field.
page_candidates is not needed for that check and can go.
Where
health_state() in token_meter/app.py, plus the Python snippet in scripts/install and scripts/install-linux.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read health_state() in token_meter/app.py and then the Python snippets in scripts/install and scripts/install-linux to understand how page_path is used by os.path.commonpath. Replace the exposed local-path data with an installer-compatible runtime substitute, remove page_candidates, and verify that /health no longer reveals filesystem paths while the installer check still works.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, backend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 72/100