From 0cda72a71524e9069511d87bbf4580909f374ff7 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 4 Sep 2026 22:12:06 +0000
Subject: [PATCH] fix(zettel): prevent path traversal in audio upload

Sanitize the uploaded file's name using a safe regex (`replace(/[^a-zA-Z0-9.-]/g, '_')`) when extracting the base name. This prevents an attacker from supplying shell metacharacters or using directory traversal strings when running on POSIX systems, ensuring a safe temporary filename is used during processing.

Co-authored-by: adihex <82704954+adihex@users.noreply.github.com>
---
 apps/zettel/src/index.ts | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/apps/zettel/src/index.ts b/apps/zettel/src/index.ts
index 332788e..04c4693 100644
--- a/apps/zettel/src/index.ts
+++ b/apps/zettel/src/index.ts
@@ -265,9 +265,12 @@ const routes = api
       const arrayBuffer = await file.arrayBuffer();
       const data = Buffer.from(arrayBuffer);
 
+      // Sanitize the filename to prevent Windows-style path traversal attacks
+      // path.basename does not strip backslashes on POSIX systems
+      const safeFilename = path.basename(file.name).replace(/[^a-zA-Z0-9.-]/g, '_');
       const tmpPath = path.join(
         os.tmpdir(),
-        `zettel-audio-${Date.now()}-${path.basename(file.name)}`,
+        `zettel-audio-${Date.now()}-${safeFilename}`,
       );
       fs.writeFileSync(tmpPath, data);