fix: starlette path security issue and update dependencies (#1404)

Author: vincentsarago

.github/workflows/ci.yml

@@ -53,32 +53,15 @@ jobs:
         run: |
           uv sync
 
-      - name: Test titiler.core
-        run: |
-          uv run pytest src/titiler/core --cov=titiler.core --cov-report=xml:titiler-core.xml --cov-report=term-missing
-
-      - name: Test titiler.extensions
-        run: |
-          uv run pytest src/titiler/extensions --cov=titiler.extensions --cov-report=xml:titiler-extensions.xml --cov-report=term-missing
-
-      - name: Test titiler.xarray
-        run: |
-          uv run pytest src/titiler/xarray --cov=titiler.xarray --cov-report=xml:titiler-xarray.xml --cov-report=term-missing
-
-      - name: Test titiler.mosaic
-        run: |
-          uv run pytest src/titiler/mosaic --cov=titiler.mosaic --cov-report=xml:titiler-mosaic.xml --cov-report=term-missing
-
-      - name: Test titiler.application
-        run: |
-          uv run pytest src/titiler/application --cov=titiler.application --cov-report=xml:titiler-application.xml  --cov-report=term-missing
-
       - name: run pre-commit and mypy
         if: ${{ matrix.python-version == env.LATEST_PY_VERSION }}
         run: |
           uv run pre-commit run --all-files
           uv run --with mypy --with types-attrs --with types-simplejson mypy -p titiler.core -p titiler.extensions -p titiler.xarray -p titiler.application -p titiler.mosaic  --ignore-missing-imports
 
+      - name: Test titiler modules
+        run: ./scripts/test
+
       - name: Upload Results
         if: ${{ matrix.python-version == env.LATEST_PY_VERSION }}
         uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0

CONTRIBUTING.md

@@ -49,19 +49,25 @@ Each `titiler`'s modules has its own test suite which can be ran independently
 
 ```
 # titiler.core
-uv run pytest src/titiler/core --cov=titiler.core --cov-report=xml --cov-append --cov-report=term-missing
+uv run pytest src/titiler/core --cov=titiler.core -cov-report=term-missing
 
 # titiler.extensions
-uv run pytest src/titiler/extensions --cov=titiler.extensions --cov-report=xml --cov-append --cov-report=term-missing
+uv run pytest src/titiler/extensions --cov=titiler.extensions --cov-report=term-missing
 
 # titiler.mosaic
-uv run pytest src/titiler/mosaic --cov=titiler.mosaic --cov-report=xml --cov-append --cov-report=term-missing
+uv run pytest src/titiler/mosaic --cov=titiler.mosaic --cov-report=term-missing
 
 # titiler.xarray
-uv run pytest src/titiler/xarray --cov=titiler.xarray --cov-report=xml --cov-append --cov-report=term-missing
+uv run pytest src/titiler/xarray --cov=titiler.xarray --cov-report=term-missing
 
 # titiler.application
-uv run pytest src/titiler/application --cov=titiler.application --cov-report=xml --cov-append --cov-report=term-missing
+uv run pytest src/titiler/application --cov=titiler.application --cov-report=term-missing
+```
+
+or all at once:
+
+```bash
+./scripts/test
 ```
 
 ### Docs

scripts/test

@@ -1,15 +1,15 @@
 #! /usr/bin/env bash
 
-SUBPACKAGE_DIRS=(
+SUBMODULES=(
     "core"
     "xarray"
     "mosaic"
     "application"
     "extensions"
 )
 
-for PACKAGE_DIR in "${SUBPACKAGE_DIRS[@]}"
+for SUBMODULE in "${SUBMODULES[@]}"
 do
-    echo "Running tests for titiler-${PACKAGE_DIR}"
-    uv run pytest src/titiler/${PACKAGE_DIR}
+    echo "Running tests for titiler-${SUBMODULE}"
+    uv run pytest src/titiler/${SUBMODULE} --cov=titiler.${SUBMODULE} --cov-report=xml:titiler-${SUBMODULE}.xml  --cov-report=term-missing
 done

src/titiler/core/pyproject.toml

@@ -30,7 +30,7 @@ classifiers = [
 ]
 dynamic = ["version"]
 dependencies = [
-    "fastapi>=0.108.0",
+    "fastapi>=0.136.1",
     "geojson-pydantic>=1.1.2,<3.0",
     "jinja2>=2.11.2,<4.0.0",
     "numpy",

src/titiler/core/titiler/core/middleware.py

@@ -114,7 +114,7 @@ async def __call__(self, scope: Scope, receive: Receive, send: Send):
             "http.url": str(request.url),
             "http.scheme": request.url.scheme,
             "http.host": request.headers.get("host", request.url.hostname or "unknown"),
-            "http.target": request.url.path
+            "http.target": request.scope["path"]
             + (f"?{request.url.query}" if request.url.query else ""),
             "http.user_agent": request.headers.get("user-agent"),
             "http.referer": next(
@@ -145,7 +145,7 @@ async def __call__(self, scope: Scope, receive: Receive, send: Send):
         data["titiler.path_params"] = request.path_params
 
         self.logger.info(
-            f"Request received: {request.url.path} {request.method}",
+            f"Request received: {request.scope['path']} {request.method}",
             extra=data,
         )
         if exception:

src/titiler/core/titiler/core/utils.py

@@ -409,7 +409,7 @@ def create_html_response(
     **kwargs: Any,
 ) -> _TemplateResponse:
     """Create Template response."""
-    urlpath = request.url.path
+    urlpath = request.scope["path"]
     if root_path := request.scope.get("root_path"):
         urlpath = re.sub(r"^" + root_path, "", urlpath)