Fizz

Dockerfile

@@ -13,4 +13,4 @@ COPY --chown=user ./requirements.txt requirements.txt
 RUN pip install --no-cache-dir --upgrade -r requirements.txt
 
 COPY --chown=user . /app
-CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "7860"]
+CMD ["python", "start_dashboard.py"]

config.yaml

@@ -0,0 +1,2 @@
+output:
+  sessions_dir: "sessions"

dashboard.yaml

@@ -1,6 +1,6 @@
 server:
-  host: "127.0.0.1"
-  port: 8050
+  host: "0.0.0.0"
+  port: 7860
   debug: false
 
 theme:

requirements.txt

@@ -1 +1,5 @@
-plot
+dash
+pandas
+plotly
+pyarrow
+pyyaml

src/dash_callbacks.py

@@ -1,3 +1,4 @@
+import html
 from dash import ClientsideFunction, Input, Output, State, dcc, no_update  #type: ignore
 from .dash_data import load_session
 from .dash_figures import multiline, track_map
@@ -14,10 +15,13 @@ def register_callbacks(app, cfg: dict):
         if not session:
             return ""
         _, info = load_session(sessions_dir, session)
-        track = info["track"]
+        track = html.escape(info["track"])
         if info.get("track_configuration"):
-            track += f" ({info['track_configuration']})"
-        return f"Car: {info['car']}  |  Track: {track}  |  Max RPM: {info['max_rpm']}  |  Fuel: {info['max_fuel_kg']} kg"
+            track += f" ({html.escape(info['track_configuration'])})"
+        car      = html.escape(str(info['car']))
+        max_rpm  = html.escape(str(info['max_rpm']))
+        max_fuel = html.escape(str(info['max_fuel_kg']))
+        return f"Car: {car}  |  Track: {track}  |  Max RPM: {max_rpm}  |  Fuel: {max_fuel} kg"
 
     # show/hide the two content areas based on active tab
     @app.callback(

src/dash_data.py

@@ -12,7 +12,10 @@ def list_sessions(sessions_dir: str) -> list[str]:
 
 
 def load_session(sessions_dir: str, name: str) -> tuple[pd.DataFrame, dict]:
-    base = Path(sessions_dir) / name
+    base = Path(sessions_dir).resolve() / Path(name).name
+    if not str(base).startswith(str(Path(sessions_dir).resolve())):
+        raise ValueError(f"Invalid session: {name}")
+    base = base
     df = pd.read_parquet(base / "telemetry.parquet")
     df["t"] = df["timestamp"] - df["timestamp"].iloc[0]
     info = json.loads((base / "session_info.json").read_text())