Improper Assets Management in Bottle applications often manifests as directory traversal or the exposure of sensitive files through overly permissive static file routing. Attackers exploit these misconfigurations to leak source code, environment variables, or internal configuration files. As an AppSec researcher, your goal is to enforce strict boundaries on asset resolution and ensure the application doesn't leak its internal filesystem structure.

The Vulnerable Pattern

from bottle import route, static_file, run
VULNERABLE: Allowing arbitrary path access with no sanitization
@route(‘/assets/filepath:path’)
def server_static(filepath):
return static_file(filepath, root=‘/var/www/static/’)
if name == ‘main’:
run(debug=True) # DANGEROUS: Debug mode in production leaks stack traces

The Secure Implementation

The fix involves three layers of defense. First, we use os.path.abspath and startswith() to prevent 'Path Traversal' attacks where an attacker uses '../' to escape the asset directory. Second, we implement an allow-list for file extensions to prevent the leakage of sensitive files like .env, .git, or .py source files that might exist in the assets folder. Finally, we disable Bottle's debug mode, which prevents the framework from exposing internal server variables and code snippets during an exception, effectively hardening the asset management lifecycle.

import os
from bottle import route, static_file, HTTPError, run
BASE_DIR = os.path.abspath(”./static”)
@route(‘/assets/filepath:path’)
def server_static(filepath):
# SECURE: Normalize path and verify it stays within the intended root
target_path = os.path.abspath(os.path.join(BASE_DIR, filepath))
if not target_path.startswith(BASE_DIR):
raise HTTPError(403, “Access Denied”)
# SECURE: Only serve specific allowed extensions
allowed_ext = {'.jpg', '.png', '.css', '.js'}
if not any(target_path.endswith(ext) for ext in allowed_ext):
    raise HTTPError(403, "File type not permitted")

return static_file(filepath, root=BASE_DIR)
if name == ‘main’:
# SECURE: Disable debug and specify host
run(debug=False, host=‘127.0.0.1’, port=8080)