🔒 Fix path traversal vulnerability in cacheRoot and tempRoot

[seonghobae]

🎯 What: The vulnerability fixed
A path traversal vulnerability in services/analysis-engine/src/bandscope_analysis/api.py via the cacheRoot and tempRoot request parameters. The parameters were being concatenated without proper sanitization.

⚠️ Risk: The potential impact if left unfixed
A malicious payload containing ../ in cacheRoot or tempRoot could allow a user or another process to write cache and temp files outside of the designated directories (e.g. overwriting critical system files or unauthorized access to other directories).

🛡️ Solution: How the fix addresses the vulnerability
Added explicit validation logic within validate_analysis_job_request to reject any cacheRoot or tempRoot path that contains ... This effectively blocks basic directory ascension payloads. Added corresponding test cases in test_api.py.

---

PR created automatically by Jules for task 9456906107932322506 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[opencode-agent]

OpenCode Review Overview

• Head SHA: 3cb931921bd19d9111b926a069da4de99d62a78e
• Workflow run: 27912987924
• Workflow attempt: 1
• Gate result: OPENCODE_REVIEW_UNAVAILABLE (approval step)

OpenCode Agent did not produce a valid review payload after all current-head GitHub Checks completed.

• Result: OPENCODE_REVIEW_UNAVAILABLE
• Reason: OpenCode review attempts did not complete or did not return a valid control block.
• OpenCode outcomes: primary=failed, fallback=failed, second_fallback=failed

OpenCode runtime evidence:

• primary model call failed: Request body too large for gpt-5 model. Max size: 4000 tokens.
• Head SHA: 3cb931921bd19d9111b926a069da4de99d62a78e
• Workflow run: 27912987924
• Workflow attempt: 1

No blocking review was submitted because this is an agent/runtime failure, not a source-backed code finding.