djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

Affected version / file / line

Version: djust v1.1.4 (latest release, published 2026-09-23). File: python/djust/mcp/server.py:354-433 (MCP tool find_handlers_for_template). Confirmed identical on the commit used for triage, a7e4fafd1667b4db0b1465652d4a63cb17117a07.

Description

@mcp.tool()
def find_handlers_for_template(template_path: str) -> str:
    """
    Args:
        template_path: Either a logical template name (e.g.
            'demos/counter.html' — what you'd pass to `render`) OR
            an absolute filesystem path. Both are searched.
    """
    ...
    resolved_path: str | None = None
    if os.path.isabs(template_path) and os.path.isfile(template_path):
        resolved_path = template_path
    else:
        ...  # logical-name resolution via Django's template loader
    ...
    with open(resolved_path, "r", encoding="utf-8", errors="replace") as f:
        source = f.read()
    handler_names_in_template = sorted({m.group(2) for m in dj_event_attr_re.finditer(source)})

When template_path is an absolute path to an existing file, it is used directly, with no confinement to the project/template directories — no realpath() + prefix check, no allowlist. open(resolved_path, ...) then reads the file.

This is inconsistent with the sibling tool in the same file (loaddata, ~line 290-303), which explicitly rejects paths outside the project directory for its own path-like parameter:

candidate = os.path.realpath(...)
if base_dir and not candidate.startswith(os.path.realpath(str(base_dir))):
    return json.dumps({"error": f"fixture path '{p}' resolves outside the project directory", ...})

find_handlers_for_template has no equivalent check for template_path before the open() call.

Impact

An MCP client with access to this tool (available whenever the Django project is running the MCP server via python manage.py djust_mcp — no separate opt-in flag gates this specific tool beyond that) can read the contents of any file on disk that the process has read permission to and that exists, by passing an absolute path — e.g. /etc/passwd, application .env files, SSH keys, or any other sensitive file reachable by the server process's user.