jarianc/kokorotts-server
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix: close #1-#2 - sanitize title parameter with secure_filename to prevent path traversal attacks

Browse Source
This commit is contained in:
Jarian 2026-07-05 12:45:38 +00:00
parent 092801ad84
commit c58788ba19
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
app.py
View File

@ -176,6 +176,11 @@ def text_to_speech():
if not text or not title: if not text or not title:
return jsonify({"error": "Both 'text' and 'title' fields are required"}), 400 return jsonify({"error": "Both 'text' and 'title' fields are required"}), 400
# Sanitize title to prevent path traversal attacks
safe_title = secure_filename(title)
if not safe_title:
return jsonify({"error": "Invalid title format"}), 400
# Parse the text to identify speakers and their complete conversations # Parse the text to identify speakers and their complete conversations
(speakers, tracks) = parse_speaker_text(text) (speakers, tracks) = parse_speaker_text(text)
@ -186,13 +191,13 @@ def text_to_speech():
speaker_voice_map = assign_voices_to_speakers(speakers) speaker_voice_map = assign_voices_to_speakers(speakers)
# Generate individual WAV files for each speaker # Generate individual WAV files for each speaker
wav_files = generate_wav_files(speakers, speaker_voice_map, title, tracks) wav_files = generate_wav_files(speakers, speaker_voice_map, safe_title, tracks)
if not wav_files: if not wav_files:
return jsonify({"error": "Failed to generate audio files"}), 500 return jsonify({"error": "Failed to generate audio files"}), 500
# Merge all generated WAV files into a single podcast file # Merge all generated WAV files into a single podcast file
final_wav_path = os.path.join(OUTPUT_DIR, f"{title}.wav") final_wav_path = os.path.join(OUTPUT_DIR, f"{safe_title}.wav")
merged_file = merge_wav_files(wav_files, final_wav_path) merged_file = merge_wav_files(wav_files, final_wav_path)
if not merged_file: if not merged_file: