chore: try to fix: https://github.com/DaanSelen/WGDashboard5/security/code-scanning/2

src/main.py

@@ -39,8 +39,7 @@ if __name__ == '__main__':
     prefix = config_server.get('app_prefix', '')
 
     # Configure the Flask app
-    app = flask.Flask(
-        "WGDashboard",
+    app = flask.Flask("WGDashboard",
         template_folder=os.path.abspath("./static/dist/WGDashboardAdmin"),
         static_folder=os.path.abspath("./static/dist/WGDashboardAdmin")
     )

src/modules/routes/routes.py

@@ -85,21 +85,31 @@ def api_authenticate():
     
     return make_resp_obj("Authentication required", {}, 401)
 
-@routes.route("/", defaults={"path": ""})
-@routes.route("/<path:path>")
-def catch_all(path):
+@routes.route('/', defaults={'path': ''})
+@routes.route('/<path:path>')
+def index_handler(path):
     static_folder = flask.current_app.static_folder
     template_folder = flask.current_app.template_folder
 
-    file_path = os.path.join(static_folder, path)
-    if os.path.isfile(file_path):
-        return flask.send_from_directory(static_folder, path)
+    safe_path = os.path.normpath(path)
 
-    return flask.send_from_directory(template_folder, "index.html")
+    if safe_path.startswith('..'):
+        return make_resp_obj("Invalid request", {}, 400)
+
+    file_path = os.path.join(static_folder, safe_path)
+    if os.path.isfile(file_path):
+        return flask.send_from_directory(static_folder, safe_path)
+
+    return flask.send_from_directory(flask.current_app.static_folder, "index.html")
+
+@routes.route("/client")
+@routes.route("/clients")
+def client_handler():
+    return flask.send_from_directory(CLIENT_DIST, "client.html")
 
 @routes.route('/health', methods=["GET"])
 @routes.route('/healthz', methods=["GET"])
-def health():
+def health_handler():
     return make_resp_obj(
         "Health Endpoint",
         {"status": "ok"},