From 39f552d58953505f9adf2540f6a6967e53d43624 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Thu, 26 Feb 2026 19:09:06 +0000
Subject: [PATCH] Fix: Prevent arbitrary file overwrite in backup_parent_seed

This change mitigates an arbitrary file overwrite vulnerability in the
`backup_parent_seed` API endpoint. Previously, the endpoint did not
check if the destination file already existed, allowing attackers or
accidental misuse to overwrite critical files if the path validation
passed.

The fix introduces a check using `resolved_path.exists()` after path
validation. If the file exists, the request is rejected with a
409 Conflict error.

A reproduction test case confirmed the vulnerability and verified the
fix. Regression tests on the API passed successfully.

Co-authored-by: PR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
---
 src/seedpass/api.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/seedpass/api.py b/src/seedpass/api.py
index 43e613fd..02f2fc8c 100644
--- a/src/seedpass/api.py
+++ b/src/seedpass/api.py
@@ -781,7 +781,9 @@ def backup_parent_seed(
     if not path_str:
         raise HTTPException(status_code=400, detail="Missing path")
     path = Path(path_str)
-    _validate_encryption_path(request, path)
+    resolved_path = _validate_encryption_path(request, path)
+    if resolved_path.exists():
+        raise HTTPException(status_code=409, detail="File already exists")
     pm.encryption_manager.encrypt_and_save_file(pm.parent_seed.encode("utf-8"), path)
     return {"status": "saved", "path": str(path)}