jarianc/kokorotts-server
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix: close #1-#2 - sanitize title parameter with secure_filename to prevent path traversal attacks

Browse Source
This commit is contained in:
Jarian 2026-07-05 12:45:38 +00:00
parent 092801ad84
commit c58788ba19
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
app.py
View File

@ -176,6 +176,11 @@ def text_to_speech():
if not text or not title:
return jsonify({"error": "Both 'text' and 'title' fields are required"}), 400
# Sanitize title to prevent path traversal attacks
safe_title = secure_filename(title)
if not safe_title:
return jsonify({"error": "Invalid title format"}), 400
# Parse the text to identify speakers and their complete conversations
(speakers, tracks) = parse_speaker_text(text)
@ -186,13 +191,13 @@ def text_to_speech():
speaker_voice_map = assign_voices_to_speakers(speakers)
# Generate individual WAV files for each speaker
wav_files = generate_wav_files(speakers, speaker_voice_map, title, tracks)
wav_files = generate_wav_files(speakers, speaker_voice_map, safe_title, tracks)
if not wav_files:
return jsonify({"error": "Failed to generate audio files"}), 500
# Merge all generated WAV files into a single podcast file
final_wav_path = os.path.join(OUTPUT_DIR, f"{title}.wav")
final_wav_path = os.path.join(OUTPUT_DIR, f"{safe_title}.wav")
merged_file = merge_wav_files(wav_files, final_wav_path)
if not merged_file: