🛡️ Sentinel: [MEDIUM] Fix DoS and enhance path validation

[socialawy-dev]

🚨 Severity: MEDIUM
💡 Vulnerability:

1. The custom SafeStaticFiles middleware crashed with an AttributeError due to Path(path).lower() because Path objects don't have a .lower() method. This unhandled exception caused the server to crash when resolving requests to static paths.
2. The validate_path_within utility could expose internal stack traces or crash entirely when processing badly malformed paths or receiving None inputs, rather than returning securely.

🎯 Impact:

1. Denial of Service (DoS): Any request going to a static path crashed the server logic in the middleware, returning a 500 error and effectively preventing static files from being served correctly.
2. An attacker could potentially bypass validation or trigger unhandled exceptions causing the server to crash by injecting specifically crafted malformed path inputs.

🔧 Fix:

1. In src/audioformation/server/app.py, corrected the path instantiation to Path(path.lower()) ensuring that the string is converted to lowercase before path object creation.
2. In src/audioformation/utils/security.py, updated the validate_path_within try-except block to additionally catch TypeError and AttributeError, allowing the function to fail securely and return False on malformed inputs.

✅ Verification:

1. Verified changes with test coverage explicitly for security (uv run pytest tests/test_security.py --no-cov) and server routing (uv run pytest tests/test_server_routes.py --no-cov), achieving 100% pass rates.
2. Confirmed that simulating a Path initialization error now behaves as expected without crashing the application flow.

---

PR created automatically by Jules for task 11619480154247741950 started by @socialawy

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[gemini-code-assist]

Code Review

This pull request fixes a Denial of Service vulnerability in the SafeStaticFiles middleware by ensuring .lower() is called on the path string rather than the Path object, and updates the sentinel documentation accordingly. It also expands exception handling in the path validation utility. A security improvement was suggested for the path filtering logic to check all path components for sensitive patterns like .env to prevent potential directory-based bypasses.

[gemini-code-assist]

The current check using p.name.startswith(".env") only validates the final component of the path. If a directory is named .env (or starts with .env), its contents would not be blocked by this condition (e.g., a request to .env/secrets.json would have p.name == "secrets.json"). To ensure all sensitive resources are blocked regardless of their position in the path hierarchy, it is safer to check all path components using p.parts.

Suggested change

	if "00_config" in p.parts or p.name.startswith(".env") or ".git" in p.parts:
	if any(part in ("00_config", ".git") or part.startswith(".env") for part in p.parts):

[socialawy]

Superseded by #90 (merged ac23b55). The Sentinel/Jules SafeStaticFiles chain was iterating on the same middleware; #90's Path(str(path).lower()) fix addresses the root AttributeError. Closing as duplicate; re-open if a distinct vulnerability emerges.

[google-labs-jules]

Superseded by #90 (merged ac23b55). The Sentinel/Jules SafeStaticFiles chain was iterating on the same middleware; #90's Path(str(path).lower()) fix addresses the root AttributeError. Closing as duplicate; re-open if a distinct vulnerability emerges.

Understood. Acknowledging that this work is now obsolete and stopping work on this task.