From f54ca840455c8a0cc7ff3784f5218d2b0e00aae7 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Fri, 24 Apr 2026 21:16:13 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[MEDIUM]=20?= =?UTF-8?q?Fix=20Exception=20Details=20Leakage=20in=20API=20response?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: socialawy <24765060+socialawy@users.noreply.github.com> --- .jules/sentinel.md | 6 +++++- src/audioformation/server/routes.py | 3 ++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.jules/sentinel.md b/.jules/sentinel.md index 9bd8528..c206a14 100644 --- a/.jules/sentinel.md +++ b/.jules/sentinel.md @@ -1,4 +1,8 @@ ## 2025-02-21 - Path Traversal in Mix Endpoint API Parameter **Vulnerability:** The `/projects/{project_id}/mix` API endpoint in `src/audioformation/server/routes.py` accepted a `music` parameter (meant to specify a filename within the `05_MUSIC/generated` directory) but directly passed it to `mix_project` without sanitization. This allowed directory traversal payloads like `../../../etc/passwd` to be used for background music resolution. **Learning:** Even internal API inputs that map strictly to filenames inside an expected directory must be sanitized. A simple check for file existence (`if not bg_music_path.exists():`) is insufficient as it confirms existence but allows looking outside the bounded directory. -**Prevention:** Always use established sanitization helpers (like `sanitize_filename`) or bound checks (like `validate_path_within`) for any user-supplied string that forms part of a filesystem path. Ensure bypass parameters like `FORCE_NO_MUSIC` are handled before and mutually exclusively from sanitization. \ No newline at end of file +**Prevention:** Always use established sanitization helpers (like `sanitize_filename`) or bound checks (like `validate_path_within`) for any user-supplied string that forms part of a filesystem path. Ensure bypass parameters like `FORCE_NO_MUSIC` are handled before and mutually exclusively from sanitization. +## 2025-02-21 - Exception Details Leakage in Ingest Endpoint +**Vulnerability:** The `/projects/{project_id}/ingest` API endpoint in `src/audioformation/server/routes.py` returned the raw exception string in the `detail` field of the HTTP 500 response (`Upload failed: {e}`). +**Learning:** Exposing internal exception details (like file system errors, internal state, or stack traces) to the client can give attackers insight into the internal workings of the application. Error handling should log the details server-side and return generic error messages to the client. +**Prevention:** Always log the exception object using a logger (e.g., `logger.error()`) internally, and return a sanitized, generic error message (e.g., `detail="Upload failed"`) to the client in the `HTTPException`. diff --git a/src/audioformation/server/routes.py b/src/audioformation/server/routes.py index 34c9bec..d216eb6 100644 --- a/src/audioformation/server/routes.py +++ b/src/audioformation/server/routes.py @@ -185,7 +185,8 @@ async def ingest_files( shutil.copyfileobj(file.file, buffer) except Exception as e: shutil.rmtree(tmp_dir, ignore_errors=True) - raise HTTPException(status_code=500, detail=f"Upload failed: {e}") + logger.error(f"Upload failed for project {project_id}: {e}") + raise HTTPException(status_code=500, detail="Upload failed") background_tasks.add_task( _run_with_status,