Skip to content

Bug: _validate_log_path silently drops subdirectory components in logs.py #2194

Closed

Description

@mrveiss

Problem

In autobot-backend/api/logs.py, the _validate_log_path function introduced in PR #2101 (#1721) uses Path(file_path).name which extracts only the final filename component, silently dropping any subdirectory:

def _validate_log_path(file_path) -> Path:
    return validate_relative_path(str(Path(file_path).name), LOG_DIR)

For example, Path("/opt/autobot/logs/subdir/app.log").name returns "app.log", so the validated path becomes LOG_DIR/app.log instead of LOG_DIR/subdir/app.log.

Impact

  • Requests for nested log files silently resolve to wrong paths (404 or wrong file)
  • Behavioral regression from the previous implementation which preserved subdirectory structure
  • Severity: medium — current log storage may be flat, but the code is objectively wrong

Fix

Pass the filename directly rather than going through LOG_DIR / filename and stripping back:

def _validate_log_path(filename: str) -> Path:
    return validate_relative_path(filename, LOG_DIR)

Discovered During

Code review of PR #2101 (working on #1721)

Activity

  1. github-actions commented on Mar 24, 2026

    @github-actions
    Contributor

    PR #2285 (merged to Dev_new_gui) references this issue with a close keyword.

    fix(logs): preserve subdirectory in _validate_log_path (#2194)

    If this issue is fully resolved, close it manually. If work remains, no action is needed.

  2. mrveiss commented on Mar 24, 2026

    @mrveiss
    OwnerAuthor

    Fixed in PR #2285 — subdirectory preserved in _validate_log_path.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions