🛡️ Sentinel: [CRITICAL/HIGH] Fix SafeStaticFiles path validation AttributeError

.jules/sentinel.md

@@ -1,4 +1,8 @@
 ## 2025-02-21 - Path Traversal in Mix Endpoint API Parameter
 **Vulnerability:** The `/projects/{project_id}/mix` API endpoint in `src/audioformation/server/routes.py` accepted a `music` parameter (meant to specify a filename within the `05_MUSIC/generated` directory) but directly passed it to `mix_project` without sanitization. This allowed directory traversal payloads like `../../../etc/passwd` to be used for background music resolution.
 **Learning:** Even internal API inputs that map strictly to filenames inside an expected directory must be sanitized. A simple check for file existence (`if not bg_music_path.exists():`) is insufficient as it confirms existence but allows looking outside the bounded directory.
-**Prevention:** Always use established sanitization helpers (like `sanitize_filename`) or bound checks (like `validate_path_within`) for any user-supplied string that forms part of a filesystem path. Ensure bypass parameters like `FORCE_NO_MUSIC` are handled before and mutually exclusively from sanitization.
+**Prevention:** Always use established sanitization helpers (like `sanitize_filename`) or bound checks (like `validate_path_within`) for any user-supplied string that forms part of a filesystem path. Ensure bypass parameters like `FORCE_NO_MUSIC` are handled before and mutually exclusively from sanitization.
+## 2024-05-24 - Fix SafeStaticFiles path validation AttributeError
+**Vulnerability:** The application was throwing an `AttributeError` during static file path validation because it was trying to call `.lower()` on a `Path` object in `src/audioformation/server/app.py` (`Path(path).lower()`). This resulted in an unhandled exception, causing the application to crash or return a 500 error when serving any static files.
+**Learning:** `PosixPath` objects do not have a `lower()` method. Path strings should be normalized *before* being passed to `Path()`. This code would fail on the first request for a static file and completely break the frontend or block valid operations.
+**Prevention:** Always ensure string operations are performed on string types before casting them to Path objects, and include integration tests that actually make requests to the running application to catch obvious typos in core middleware/routing.

src/audioformation/server/app.py

@@ -24,7 +24,7 @@ class SafeStaticFiles(StaticFiles):
 
     async def get_response(self, path: str, scope) -> Response:
         # Normalize path for check
-        p = Path(path).lower()
+        p = Path(path.lower())
         if "00_config" in p.parts or p.name.startswith(".env") or ".git" in p.parts:
             raise HTTPException(
                 status_code=403, detail="Access denied to sensitive resource"