🛡️ Sentinel: [MEDIUM] Fix error handling in SafeStaticFiles

.jules/sentinel.md

@@ -1,4 +1,8 @@
 ## 2025-02-21 - Path Traversal in Mix Endpoint API Parameter
 **Vulnerability:** The `/projects/{project_id}/mix` API endpoint in `src/audioformation/server/routes.py` accepted a `music` parameter (meant to specify a filename within the `05_MUSIC/generated` directory) but directly passed it to `mix_project` without sanitization. This allowed directory traversal payloads like `../../../etc/passwd` to be used for background music resolution.
 **Learning:** Even internal API inputs that map strictly to filenames inside an expected directory must be sanitized. A simple check for file existence (`if not bg_music_path.exists():`) is insufficient as it confirms existence but allows looking outside the bounded directory.
-**Prevention:** Always use established sanitization helpers (like `sanitize_filename`) or bound checks (like `validate_path_within`) for any user-supplied string that forms part of a filesystem path. Ensure bypass parameters like `FORCE_NO_MUSIC` are handled before and mutually exclusively from sanitization.
+**Prevention:** Always use established sanitization helpers (like `sanitize_filename`) or bound checks (like `validate_path_within`) for any user-supplied string that forms part of a filesystem path. Ensure bypass parameters like `FORCE_NO_MUSIC` are handled before and mutually exclusively from sanitization.
+## 2025-02-21 - Denial of Service / Broken Security Check via AttributeError in SafeStaticFiles
+**Vulnerability:** In `src/audioformation/server/app.py`, `SafeStaticFiles` intended to block access to sensitive files (like `00_CONFIG` and `.env`) using path checking. However, the path check `p = Path(path).lower()` caused an `AttributeError` because `Path` objects don't have a `.lower()` method. This resulted in a 500 error, breaking the file serving and potentially leaking stack traces.
+**Learning:** Security checks that crash fail safely in the sense of denying access, but act as a Denial of Service and leak internal states. Furthermore, attempting to use string methods on non-string objects is a frequent source of bypasses or crashes in input validation.
+**Prevention:** Ensure input normalization explicitly handles the correct data types (e.g., lowercasing the string before passing it into an object constructor). Always test security control edge cases or paths to confirm they execute properly and return correct HTTP status codes (e.g., 403 Forbidden) instead of unhandled exceptions.

src/audioformation/server/app.py

@@ -24,7 +24,10 @@ class SafeStaticFiles(StaticFiles):
 
     async def get_response(self, path: str, scope) -> Response:
         # Normalize path for check
-        p = Path(path).lower()
+        # Convert path to lower case before instantiating Path to avoid AttributeError.
+        # This safely normalizes the path for checking sensitive files without causing
+        # a 500 error that could leak stack traces, failing securely with a 403 instead.
+        p = Path(path.lower())
         if "00_config" in p.parts or p.name.startswith(".env") or ".git" in p.parts:
             raise HTTPException(
                 status_code=403, detail="Access denied to sensitive resource"