Added symlink checks to static file handler

ogc/edr/edr_routes.py

@@ -111,7 +111,7 @@ def static_files(self, request: pygeoapi.api.APIRequest, file_path: str) -> Tupl
 
         # Use a safe join to ensure the untrusted path is a subpath of the trusted static directory
         safe_path = safe_join(static_path, file_path)
-        if safe_path is not None and os.path.isfile(safe_path):
+        if safe_path is not None and os.path.isfile(safe_path) and not os.path.islink(safe_path):
             mime_type, _ = mimetypes.guess_type(safe_path)
             mime_type = mime_type or "application/octet-stream"
             with open(safe_path, "rb") as f:

ogc/edr/test/test_edr_routes.py

@@ -3,6 +3,7 @@
 import pytest
 import numpy as np
 import tempfile
+from unittest.mock import patch
 from pygeoapi.api import APIRequest
 from http import HTTPStatus
 from typing import Dict, List, Any
@@ -60,6 +61,15 @@
         assert status == HTTPStatus.NOT_FOUND
 
 
+def test_edr_routes_static_files_prevents_following_symlinks():
+    """Test the EDR static routes prevents following symlinks."""
+    request = mock_request()
+    edr_routes = EdrRoutes(layers=[])
+    with patch("os.path.islink", returns=True):
+        _, status, _ = edr_routes.static_files(request, "img/logo.png")
+        assert status == HTTPStatus.NOT_FOUND
+
+
 def test_edr_routes_static_files_invalid_path():
     """Test the EDR static routes with an invalid static file path."""
     request = mock_request()
@@ -363,7 +373,7 @@
     request = mock_request(single_layer_cube_args)
     edr_routes = EdrRoutes(layers=layers)
 
     with pytest.raises(EDRException) as exception_info:
         edr_routes.collection_query(
             request,
             collection_id=layers[0].group,