GHSA-47c3-hpmg-7j6p

### Impact Shiny for Python's bookmark-restore path accepted a client-supplied `_state_id_` query-string value and joined it into the server-side bookmark directory (`<cwd>/shiny_bookmarks/<id>`) without validating it. A value containing `..` path segments, or an absolute path, could therefore cause the server to open and parse `input.json` and `values.json` from a directory outside the bookmark store. On a default application the restore was attempted whenever the client supplied a URL query string — including when bookmarking was disabled (`bookmark_store="disable"`) — so no opt-in configuration was required. For such applications the impact is an unauthenticated, server-side probe for the existence and JSON-validity of attacker-chosen paths, constrained to those two file names. Applications configured with `bookmark_store="server"` **and** using `ui.input_file()` are affected more seriously. The file-input restore handler copies files out of the restore directory, so the contents of an attacker-selected file name within an attacker-selected directory could be read into the application. ### Affected versions 1.4.0 through 1.6.3. Bookmarking was introduced in 1.4.0; earlier releases do not contain the affected code path and are not affected. ### Patches Fixed in **1.6.4**. Upgrade with: ``` pip install --upgrade shiny ``` The fix validates bookmark IDs against an allowlist — a single path segment matching `[A-Za-z0-9_-]+`, which cannot express a path separator, a `..` parent reference, or an absolute path — before the ID is used to build a filesystem path. Bookmark IDs generated by Shiny are unaffected by this restriction. Restore is additionally gated on the application's `bookmark_store` setting at a single point, so it no longer runs when bookmarking is disabled, and the on-disk restore path is honored only under `bookmark_store="server"`. ### Workarounds There is no configuration change that mitigates this on an affected version: the restore path ran even with `bookmark_store="disable"`. Deployments that cannot upgrade immediately can strip the `_state_id_` parameter from incoming query strings at a reverse proxy or load balancer, which prevents the affected code path from being reached. ### Credits Reported by [@0xRenSec](https://github.com/0xRenSec).