🛡️ Sentinel: [security improvement] Fix information leak in upload endpoint

.jules/sentinel.md

@@ -6,3 +6,8 @@
 **Vulnerability:** The custom `SafeStaticFiles` middleware in `src/audioformation/server/app.py` intended to block access to sensitive directories (like `00_CONFIG` and `.git`). However, it used `p = Path(path).lower()`, which raises an `AttributeError` because `pathlib.Path` objects lack a `.lower()` method. This effectively broke static file serving entirely (causing 500 errors) and represented a malformed security check. If such errors were ever 'swallowed' without raising an HTTP exception, it could result in 'failing open' and allowing access to sensitive files.
 **Learning:** Security checks that rely on path manipulation or normalization must be carefully tested for runtime exceptions. An unhandled exception in a security gate can either block legitimate traffic (Denial of Service) or, if caught improperly elsewhere, fail open. Always normalize the string representation of paths before converting them to `Path` objects.
 **Prevention:** Thoroughly test security middleware endpoints for both valid and invalid access attempts. Ensure that path string normalizations like `.lower()` are applied directly to the string before instantiating `Path(str(path).lower())`.
+
+## 2025-02-23 - Information Leakage in API Response
+**Vulnerability:** The `ingest_files` API endpoint in `src/audioformation/server/routes.py` caught exceptions during file uploads and raised an `HTTPException` containing the explicit string representation of the internal exception `e` in the `detail` field (`detail=f"Upload failed: {e}"`). This is an information leakage vulnerability because an internal exception stack trace or detailed internal system message can be exposed directly to the user (e.g., in a 500 status code response), which violates the secure error message coding standard.
+**Learning:** Do not leak unhandled internal `Exception` messages or tracebacks directly into an HTTP response `detail`.
+**Prevention:** Catch generic exceptions internally, log the specific error to internal logs (e.g. `logger.exception()`), and return a generic, non-revealing error message to the client (e.g. `detail="Upload failed"`).

src/audioformation/server/routes.py

@@ -184,8 +184,9 @@ async def ingest_files(
             with open(dest, "wb") as buffer:
                 shutil.copyfileobj(file.file, buffer)
     except Exception as e:
+        logger.exception(f"Upload failed for project {project_id}: {e}")
         shutil.rmtree(tmp_dir, ignore_errors=True)
-        raise HTTPException(status_code=500, detail=f"Upload failed: {e}")
+        raise HTTPException(status_code=500, detail="Upload failed")
 
     background_tasks.add_task(
         _run_with_status,