Move to Starlette 1.3.1 and pin it explicitly - #15
Merged
dabeckham merged 1 commit intoJul 26, 2026
Conversation
Starlette is not listed in requirements.txt, so the version that actually ships is whatever FastAPI's range resolves to — 0.41.3 in the current image. Seven advisories apply to it, and two are reachable from unauthenticated requests: - CVE-2025-62727: quadratic-time Range-header merging in FileResponse. Every share download is served by FileResponse, so anyone holding a link can drive it. - CVE-2026-54283: form-body limits silently ignored for application/x-www-form-urlencoded. FastAPI parses the body before the handler runs, so the form endpoints are reachable before their own authorization checks are reached. The rest (Host-header handling that can poison request.url, arbitrary methods dispatched to HTTPEndpoint attributes, UNC paths in StaticFiles on Windows) are lower risk here but land in the same upgrade. Clearing all of them requires 1.3.1, which needs FastAPI 0.140.0 to allow the 1.x range. Starlette 1.0 removed the deprecated TemplateResponse(name, context) signature, so the seven call sites move to the current TemplateResponse(request, name, context) form. Rather than repeat that at every site, they now go through a render() helper that merges the shared base context, plus an error_page() wrapper for the three error renders. Context no longer carries "request" explicitly; Starlette injects it. Added a regression test asserting that a request arriving with an unexpected Host still lands on the canonical origin, since Host parsing is one of the things that changed underneath. Verified with the backend suite (26 tests) and the browser end-to-end suite against a staging container built from this branch, plus the same live Authentik authorization-request check as the previous dependency update.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Starlette isn't listed in
requirements.txt, so the version that actually shipsis whatever FastAPI's range resolves to. In the running image that is 0.41.3,
which carries seven advisories. Clearing all of them needs 1.3.1, which in
turn needs FastAPI 0.140.0 to allow the 1.x range. Starlette is now pinned
explicitly so it stops being invisible.
Reachability
Two of the seven are reachable without authenticating:
Rangeheader merging inFileResponse. Every share download is served byFileResponse(app/main.py), so anyone holding a link can drive it.application/x-www-form-urlencoded. FastAPI parses the body during dependency resolution, i.e. before the handler's own authorization check runs.The remainder — Host-header handling that can poison
request.url(CVE-2026-48710, CVE-2026-54282), arbitrary methods dispatched to
HTTPEndpointattributes (CVE-2026-48817), UNC paths in
StaticFileson Windows(CVE-2026-48818) — are lower risk in this deployment but land in the same
upgrade.
Code changes this forced
Starlette 1.0 removed the deprecated
TemplateResponse(name, context)signature. Rather than repeat the new three-argument form at all seven call
sites, they now go through a
render()helper that merges the shared basecontext, plus an
error_page()wrapper for the three error renders. The contextno longer carries
requestexplicitly — Starlette injects it.Net effect on
app/main.pyis a small reduction in line count.Verification
test that a request arriving with an unexpected
Hoststill lands on thecanonical origin — Host parsing is one of the things that changed underneath.
from this branch.
request and Authentik accepts it and hands off to its login flow.
sign-in after deploy.