Chainlit is failing to render UI when executed through Bazel since 0.6.1

[moonk-banksalad]

I have a Bazel-based workspace setup for a Chainlit app development. I have a py_binary target for a Chainlit app and it was working fine until 0.6.0. However, with 0.6.1 and later versions, the server starts fine but the UI is failing to render because the requests to js/css files fail. Here are the logs:

INFO:     Started server process [52356]
INFO:     Waiting for application startup.
2023-08-25 05:42:50 - Your app is available at http://localhost:8000
INFO:     Application startup complete.
INFO:     Uvicorn running on http://0.0.0.0:8000 (Press CTRL+C to quit)
INFO:     127.0.0.1:42646 - "GET / HTTP/1.1" 200 OK
INFO:     127.0.0.1:42646 - "GET /index-1c4090d7.js HTTP/1.1" 404 Not Found
INFO:     127.0.0.1:42650 - "GET /index-a6e13df6.css HTTP/1.1" 404 Not Found

I suspect this commit because Bazel creates symbolic links to dependent packages when setting up an execution sandbox directory. Maybe passing follow_symlink=True to the StaticFiles constructor may solve this problem.

[willydouhard]

Can you try adding follow_symlink=True to your local installation and see if it fixes the issue?

[moonk-banksalad]

Sure. I verified js/css files load successfully when follow_symlink option is added. Here's the snippet of my patch:

app.mount(
    "/assets",
    StaticFiles(
        packages=[("chainlit", os.path.join(build_dir, "assets"))], follow_symlink=True
    ),
    name="assets",
)

[willydouhard]

@MathiasSpanhove do you see any security issue with this?

[MathiasSpanhove]

I don't think it will be a security issue. It's a mount to the chainlit build directory so I don't think that users will be able to upload files to it and somehow using symlinks try to extract secrets. (See Zip Slip / Zip Symlink Upload Attack for examples)

If you really want to be safe, you could make it opt-in using configuration.

Interesting info about it from the starlette team themselves:
encode/starlette#1681 (comment)

[willydouhard]

The 0.6.401 release brings a follow_symlink parameter that should fix your issue!

[moonk-banksalad]

Verified that the issue is fixed in 0.6.401. Thank you!