fix: close #1-#2 - sanitize title parameter with secure_filename to prevent path traversal attacks

app.py

@@ -176,6 +176,11 @@ def text_to_speech():
     if not text or not title:
         return jsonify({"error": "Both 'text' and 'title' fields are required"}), 400
 
+    # Sanitize title to prevent path traversal attacks
+    safe_title = secure_filename(title)
+    if not safe_title:
+        return jsonify({"error": "Invalid title format"}), 400
+
     # Parse the text to identify speakers and their complete conversations
     (speakers, tracks) = parse_speaker_text(text)
 
@@ -186,13 +191,13 @@ def text_to_speech():
     speaker_voice_map = assign_voices_to_speakers(speakers)
 
     # Generate individual WAV files for each speaker
-    wav_files = generate_wav_files(speakers, speaker_voice_map, title, tracks)
+    wav_files = generate_wav_files(speakers, speaker_voice_map, safe_title, tracks)
 
     if not wav_files:
         return jsonify({"error": "Failed to generate audio files"}), 500
 
     # Merge all generated WAV files into a single podcast file
-    final_wav_path = os.path.join(OUTPUT_DIR, f"{title}.wav")
+    final_wav_path = os.path.join(OUTPUT_DIR, f"{safe_title}.wav")
 
     merged_file = merge_wav_files(wav_files, final_wav_path)
     if not merged_file: