Modified Dockerfile and entrypoint to switch user at runtime. Updated output folder file creation for custom_image_anlyser_engine and find_duplicate_pages.py

Dockerfile

@@ -51,8 +51,8 @@ RUN apt-get update \
     && rm -rf /var/lib/apt/lists/*
 
 # Create non-root user
-RUN useradd -m -u 1000 user
 ENV APP_HOME=/home/user
+RUN useradd -m -u 1000 user
 
 # Set env variables for Gradio & other apps
 ENV GRADIO_TEMP_DIR=/tmp/gradio_tmp/ \
@@ -117,18 +117,21 @@ COPY --from=builder /install /usr/local/lib/python3.12/site-packages/
 # Copy installed CLI binaries (e.g. uvicorn)
 COPY --from=builder /install/bin /usr/local/bin/
 
-# Copy app code and entrypoint with correct ownership
-COPY --chown=user . $APP_HOME/app
+# Copy app code
+COPY . $APP_HOME/app
+
+# Fix ownership if needed
+RUN if [ "$APP_MODE" = "gradio" ]; then chown -R user:user /home/user/app; fi
 
-# Copy the entrypoint script separately, set permissions, set line endings correctly
-COPY --chown=user entrypoint.sh ${APP_HOME}/app/entrypoint.sh
-RUN chmod 755 /home/user/app/entrypoint.sh \
-    && sed -i 's/\r$//' /home/user/app/entrypoint.sh
+# Copy entrypoint and fix line endings + permissions
+COPY entrypoint.sh ${APP_HOME}/app/entrypoint.sh
+RUN chmod 755 ${APP_HOME}/app/entrypoint.sh \
+    && sed -i 's/\r$//' ${APP_HOME}/app/entrypoint.sh \
+    && if [ "$APP_MODE" = "gradio" ]; then chown user:user ${APP_HOME}/app/entrypoint.sh; fi
 
-# Switch to user
-USER user
+# Set permissions for Python executable
+RUN chmod 755 /usr/local/bin/python
 
-# Declare working directory
 WORKDIR $APP_HOME/app
 
 # Declare volumes (NOTE: runtime mounts will override permissions — handle with care)

app.py

@@ -1224,7 +1224,6 @@ with blocks:
                 else:
                     handwrite_signature_checkbox.render()
 
-                print(f"SHOW_LOCAL_OCR_MODEL_OPTIONS : {SHOW_LOCAL_OCR_MODEL_OPTIONS}")
                 if SHOW_LOCAL_OCR_MODEL_OPTIONS:
                     with gr.Accordion(
                         label="Change default local OCR model",

entrypoint.sh

@@ -22,12 +22,12 @@ else
 
         # Start uvicorn server.
         echo "Starting with Uvicorn on $GRADIO_SERVER_NAME:$GRADIO_SERVER_PORT"
-        exec uvicorn app:app \
+        exec su -s /bin/sh user -c "uvicorn app:app \
             --host $GRADIO_SERVER_NAME \
             --port $GRADIO_SERVER_PORT \
-            --proxy-headers
+            --proxy-headers"
     else
         echo "Starting in Gradio mode..."
-        exec python app.py
+        exec su -s /bin/sh user -c "python app.py"
     fi    
 fi

tools/custom_image_analyser_engine.py

@@ -499,7 +499,14 @@ class CustomImageAnalyzerEngine:
         self.language = language or DEFAULT_LANGUAGE or "en"
         self.tesseract_lang = _tesseract_lang_code(self.language)
         self.paddle_lang = _paddle_lang_code(self.language)
-        self.output_folder = output_folder
+        
+        # Security: Validate and normalize output_folder at construction time
+        # This ensures the object is always in a secure state and prevents
+        # any future code from accidentally using an untrusted directory
+        normalized_output_folder = os.path.normpath(os.path.abspath(output_folder))
+        if not validate_folder_containment(normalized_output_folder, OUTPUT_FOLDER):
+            raise ValueError(f"Unsafe output folder path: {output_folder}. Must be contained within {OUTPUT_FOLDER}")
+        self.output_folder = normalized_output_folder
 
         if self.ocr_engine == "paddle" or self.ocr_engine == "hybrid":
             if PaddleOCR is None:
@@ -868,20 +875,9 @@ class CustomImageAnalyzerEngine:
             if paddle_results and SAVE_PADDLE_VISUALISATIONS is True:
 
                 for res in paddle_results:
-                    # Normalize and validate output folder path before using in path construction
-                    normalized_output_folder = os.path.normpath(
-                        os.path.abspath(self.output_folder)
-                    )
-                    # Validate the output folder is safe
-                    if not validate_folder_containment(
-                        normalized_output_folder, OUTPUT_FOLDER
-                    ):
-                        raise ValueError(
-                            f"Unsafe output folder path: {normalized_output_folder}"
-                        )
-
+                    # self.output_folder is already validated and normalized at construction time
                     paddle_viz_folder = os.path.join(
-                        normalized_output_folder, "paddle_visualisations"
+                        self.output_folder, "paddle_visualisations"
                     )
                     # Double-check the constructed path is safe
                     if not validate_folder_containment(

tools/find_duplicate_pages.py

@@ -474,9 +474,13 @@ def combine_ocr_dataframes(
             raise ValueError(
                 f"Unsafe normalized output folder path: {normalized_output_folder}"
             )
+        
+        # Assign the validated path back to output_folder to ensure all subsequent
+        # operations use the secure, validated value
+        output_folder = normalized_output_folder
 
-        os.makedirs(normalized_output_folder, exist_ok=True)
-        output_path = secure_path_join(normalized_output_folder, output_filename)
+        os.makedirs(output_folder, exist_ok=True)
+        output_path = secure_path_join(output_folder, output_filename)
         combined_df.to_csv(output_path, index=False)
         output_files.append(output_path)
         print(f"Successfully combined data and saved to: {output_path}")