fix: prevent path traversal in API host details endpoint

[tranquac]

Summary

Prevent path traversal in the apiv1_hostdetails API endpoint by sanitizing the scanfile URL parameter.

Problem

The apiv1_hostdetails function uses the scanfile URL path parameter directly in a file open call:

def apiv1_hostdetails(request, scanfile, faddress=""):
    oo = xmltodict.parse(open('/opt/xml/'+scanfile, 'r').read())

An attacker can read arbitrary files using path traversal:

• /api/v1/scan/../../etc/passwd/hosts → reads /etc/passwd

Fix

• Use os.path.basename(scanfile) to strip directory components
• Validate no path traversal characters remain
• Use os.path.join for safe path construction
• Add file existence check

Impact

• Type: Path Traversal / Arbitrary File Read (CWE-22)
• Affected endpoint: /api/v1/scan/{scanfile}/hosts
• Risk: Read any file on the server
• OWASP: A01:2021 — Broken Access Control