🛡️ Sentinel: [MEDIUM] Fix Information Disclosure & SafeStaticFiles AttributeError

[socialawy-dev]

🚨 Severity: MEDIUM
💡 Vulnerability:

1. src/audioformation/server/routes.py: The exception details were directly leaked via HTTP 500 exceptions, which is an information disclosure vulnerability.
2. src/audioformation/server/app.py: Calling .lower() on a Path object caused an AttributeError, resulting in a broken security control.
   🎯 Impact: Attackers could gain knowledge of the backend configuration via leaked stack trace exceptions. The SafeStaticFiles check was malfunctioning, meaning the intended file access blocking control could have been bypassed or could break legitimate routing completely.
   🔧 Fix:

• Modified app.py to ensure path.lower() is run before instantiating the Path object.
• Replaced the direct exception return in routes.py with logger.error to log the failure securely and send a sanitized HTTP error instead.
  ✅ Verification: Ran testing for test_server.py and test_server_routes.py effectively. Verified modifications with bash checks ensuring logic aligns.

---

PR created automatically by Jules for task 4677847503251470289 started by @socialawy

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[gemini-code-assist]

Code Review

This pull request corrects path normalization in app.py by lowercasing the path string before Path object instantiation and updates error handling in routes.py to log errors server-side while returning generic messages to clients. A suggestion was made to use logger.exception instead of logger.error in the exception handler to ensure full stack traces are captured for debugging.

[gemini-code-assist]

Using logger.exception is preferred over logger.error within an except block. It automatically captures the full stack trace, which is essential for debugging internal server errors in production, whereas logger.error with just the exception string loses this context.

Suggested change

	logger.error(f"Upload failed: {e}")
	logger.exception("Upload failed")

[socialawy]

Superseded by #90 (merged ac23b55). The Sentinel/Jules SafeStaticFiles chain was iterating on the same middleware; #90's Path(str(path).lower()) fix addresses the root AttributeError. Closing as duplicate; re-open if a distinct vulnerability emerges.

[google-labs-jules]

Superseded by #90 (merged ac23b55). The Sentinel/Jules SafeStaticFiles chain was iterating on the same middleware; #90's Path(str(path).lower()) fix addresses the root AttributeError. Closing as duplicate; re-open if a distinct vulnerability emerges.

Understood. Acknowledging that this work is now obsolete and stopping work on this task.