From c58788ba19e69878064b4c11ad5884d62a15756a Mon Sep 17 00:00:00 2001 From: Jarian Date: Sun, 5 Jul 2026 12:45:38 +0000 Subject: [PATCH] fix: close #1-#2 - sanitize title parameter with secure_filename to prevent path traversal attacks --- app.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/app.py b/app.py index bb75065..74d5fb5 100644 --- a/app.py +++ b/app.py @@ -176,6 +176,11 @@ def text_to_speech(): if not text or not title: return jsonify({"error": "Both 'text' and 'title' fields are required"}), 400 + # Sanitize title to prevent path traversal attacks + safe_title = secure_filename(title) + if not safe_title: + return jsonify({"error": "Invalid title format"}), 400 + # Parse the text to identify speakers and their complete conversations (speakers, tracks) = parse_speaker_text(text) @@ -186,13 +191,13 @@ def text_to_speech(): speaker_voice_map = assign_voices_to_speakers(speakers) # Generate individual WAV files for each speaker - wav_files = generate_wav_files(speakers, speaker_voice_map, title, tracks) + wav_files = generate_wav_files(speakers, speaker_voice_map, safe_title, tracks) if not wav_files: return jsonify({"error": "Failed to generate audio files"}), 500 # Merge all generated WAV files into a single podcast file - final_wav_path = os.path.join(OUTPUT_DIR, f"{title}.wav") + final_wav_path = os.path.join(OUTPUT_DIR, f"{safe_title}.wav") merged_file = merge_wav_files(wav_files, final_wav_path) if not merged_file: