From 8c77a1753b6289788a4a33ce1a3b9511a5068e4f Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sat, 18 Apr 2026 22:17:43 +0000 Subject: [PATCH] fix: Correct AttributeError in SafeStaticFiles Modified SafeStaticFiles in src/audioformation/server/app.py to correctly lowercase the path string before converting it to a Path object. This avoids an AttributeError that would cause a 500 server error and ensures the security check gracefully fails with a 403. Added explanatory comment. Co-authored-by: socialawy <24765060+socialawy@users.noreply.github.com> --- .jules/sentinel.md | 6 +++++- src/audioformation/server/app.py | 5 ++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/.jules/sentinel.md b/.jules/sentinel.md index 9bd8528..4799258 100644 --- a/.jules/sentinel.md +++ b/.jules/sentinel.md @@ -1,4 +1,8 @@ ## 2025-02-21 - Path Traversal in Mix Endpoint API Parameter **Vulnerability:** The `/projects/{project_id}/mix` API endpoint in `src/audioformation/server/routes.py` accepted a `music` parameter (meant to specify a filename within the `05_MUSIC/generated` directory) but directly passed it to `mix_project` without sanitization. This allowed directory traversal payloads like `../../../etc/passwd` to be used for background music resolution. **Learning:** Even internal API inputs that map strictly to filenames inside an expected directory must be sanitized. A simple check for file existence (`if not bg_music_path.exists():`) is insufficient as it confirms existence but allows looking outside the bounded directory. -**Prevention:** Always use established sanitization helpers (like `sanitize_filename`) or bound checks (like `validate_path_within`) for any user-supplied string that forms part of a filesystem path. Ensure bypass parameters like `FORCE_NO_MUSIC` are handled before and mutually exclusively from sanitization. \ No newline at end of file +**Prevention:** Always use established sanitization helpers (like `sanitize_filename`) or bound checks (like `validate_path_within`) for any user-supplied string that forms part of a filesystem path. Ensure bypass parameters like `FORCE_NO_MUSIC` are handled before and mutually exclusively from sanitization. +## 2025-02-21 - Denial of Service / Broken Security Check via AttributeError in SafeStaticFiles +**Vulnerability:** In `src/audioformation/server/app.py`, `SafeStaticFiles` intended to block access to sensitive files (like `00_CONFIG` and `.env`) using path checking. However, the path check `p = Path(path).lower()` caused an `AttributeError` because `Path` objects don't have a `.lower()` method. This resulted in a 500 error, breaking the file serving and potentially leaking stack traces. +**Learning:** Security checks that crash fail safely in the sense of denying access, but act as a Denial of Service and leak internal states. Furthermore, attempting to use string methods on non-string objects is a frequent source of bypasses or crashes in input validation. +**Prevention:** Ensure input normalization explicitly handles the correct data types (e.g., lowercasing the string before passing it into an object constructor). Always test security control edge cases or paths to confirm they execute properly and return correct HTTP status codes (e.g., 403 Forbidden) instead of unhandled exceptions. diff --git a/src/audioformation/server/app.py b/src/audioformation/server/app.py index 9334beb..a006f35 100644 --- a/src/audioformation/server/app.py +++ b/src/audioformation/server/app.py @@ -24,7 +24,10 @@ class SafeStaticFiles(StaticFiles): async def get_response(self, path: str, scope) -> Response: # Normalize path for check - p = Path(path).lower() + # Convert path to lower case before instantiating Path to avoid AttributeError. + # This safely normalizes the path for checking sensitive files without causing + # a 500 error that could leak stack traces, failing securely with a 403 instead. + p = Path(path.lower()) if "00_config" in p.parts or p.name.startswith(".env") or ".git" in p.parts: raise HTTPException( status_code=403, detail="Access denied to sensitive resource"