🛡️ Sentinel: [CRITICAL] Fix Path Traversal Crash

[socialawy-dev]

🚨 Severity: CRITICAL
💡 Vulnerability: The SafeStaticFiles block logic in src/audioformation/server/app.py contained a runtime bug due to calling Path(path).lower(). Python's Path objects do not have a .lower() method. This would crash the request processing loop for any file hitting this check with a 500 error instead of a 403 Forbidden. This unhandled exception acts as a Denial of Service and bypasses the directory traversal safeguard.
🎯 Impact: Prevents the server from processing requests for sensitive directories correctly. It returns unhandled exceptions which crash requests or may otherwise bypass expected routing paths. It also allows an attacker to spam traversal requests to cause exceptions.
🔧 Fix: Replaced Path(path).lower() with Path(path.lower()), successfully validating the casing string representation before wrapping it into a Path object for directory part verification.
✅ Verification: Verified by checking if the handler safely routes requests containing 00_config internally without unhandled exceptions. Checked by running a mock setup of FastAPI and SafeStaticFiles against an arbitrary sensitive payload.

---

PR created automatically by Jules for task 4115711445469659799 started by @socialawy

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[gemini-code-assist]

Code Review

This pull request fixes an AttributeError in the SafeStaticFiles class by correctly lowercasing the path string before creating a Path object. It also adds a corresponding entry to the sentinel documentation. A review comment identifies a potential security bypass where the check for .env files only looks at the filename; it is recommended to check all path components to ensure .env directories are also restricted.

[gemini-code-assist]

While this change correctly fixes the AttributeError by lowercasing the string before creating the Path object, the subsequent security check for .env files (on line 28) only inspects the p.name property. This means that if .env is used as a directory name (e.g., .env/secrets.json), the check will be bypassed because p.name would be secrets.json. To improve the robustness of this hardened class, consider checking if any component of the path starts with .env, similar to how 00_config and .git are checked using p.parts.

[socialawy]

Superseded by #90 (merged ac23b55). The Sentinel/Jules SafeStaticFiles chain was iterating on the same middleware; #90's Path(str(path).lower()) fix addresses the root AttributeError. Closing as duplicate; re-open if a distinct vulnerability emerges.

[google-labs-jules]

Superseded by #90 (merged ac23b55). The Sentinel/Jules SafeStaticFiles chain was iterating on the same middleware; #90's Path(str(path).lower()) fix addresses the root AttributeError. Closing as duplicate; re-open if a distinct vulnerability emerges.

Understood. Acknowledging that this work is superseded by #90 and stopping work on this task.