GHSA-47c3-hpmg-7j6p Shiny for Python has path traversal in bookmark restore

• PyPI shiny: >= 1.4.0, < 1.6.4 → fixed in 1.6.4

Impact Shiny for Python's bookmark-restore path accepted a client-supplied `_state_id_` query-string value and joined it into the server-side bookmark directory (`/shiny_bookmarks/`) without validating it. A value containing `..` path segments, or an absolute path, could therefore cause the server to open and parse `input.json` and `values.json` from a directory outside the bookmark store. On a default application the restore was attempted whenever the client supplied a URL query string — including when bookmarking was disabled (`bookmark_store="disable"`) — so no opt-in configuration was required. For such applications the impact is an unauthenticated, server-side probe for the existence and JSON-validity of attacker-chosen paths, constrained to those two file names. Applications configured with `bookmark_store="server"` and using `ui.input_file()` are affected more seriously. The file-input restore handler copies files out of the restore directory, so the contents of an attacker-selected file name within an attacker-selected directory could be read into the application. Affected versions 1.4.0 through 1.6.3. Bookmarking was introduced in 1.4.0; earlier releases do not contain the affected code path and are not affected. Patches Fixed in 1.6.4. Upgrade with: ``` pip install --upgrade shiny ``` The fix validates bookmark IDs against an allowlist — a single path segment matching `[A-Za-z0-9_-]+`, which cannot express a path separator, a `..` parent reference, or an absolute path — before the ID is used to build a filesystem path. Bookmark IDs generated by Shiny are unaffected by this restriction. Restore is additionally gated on the application's `bookmark_store` setting at a single point, so it no longer runs when bookmarking is disabled, and the on-disk restore path is honored only under `bookmark_store="server"`. Workarounds There is no configuration change that mitigates this on an affected version: the restore path ran even with `bookmark_store="disable"`. Deployments that cannot upgrade immediately can strip the `_state_id_` parameter from incoming query strings at a reverse proxy or load balancer, which prevents the affected code path from being reached. Credits Reported by @0xRenSec.