if webexports does not match, return 403

qt/aqt/mediasrv.py

@@ -90,7 +90,14 @@ class MediaServer(threading.Thread):
 @app.route("/", defaults={"path": ""})
 @app.route("/<path:pathin>", methods=["GET", "POST"])
 def allroutes(pathin):
+    try:
         directory, path = _redirectWebExports(pathin)
+    except TypeError:
+        return flask.make_response(
+            f"Invalid path: {pathin}",
+            HTTPStatus.FORBIDDEN,
+            )
+
     try:
         isdir = os.path.isdir(os.path.join(directory, path))
     except ValueError:
@@ -176,18 +183,18 @@ def _redirectWebExports(path):
         except AttributeError as error:
             if devMode:
                 print("_redirectWebExports: %s" % error)
-            return _exportFolder, addonPath
+            return None
 
         try:
             addon, subPath = addonPath.split("/", 1)
         except ValueError:
-            return addMgr.addonsFolder(), path
+            return None
         if not addon:
-            return addMgr.addonsFolder(), path
+            return None
 
         pattern = addMgr.getWebExports(addon)
         if not pattern:
-            return addMgr.addonsFolder(), path
+            return None
 
         if re.fullmatch(pattern, subPath):
             return addMgr.addonsFolder(), addonPath