* fix(dub): key per-segment WAVs by stable id, not list index (#185)
Partial regeneration ('regenerate only changed segments') reloaded/wrote
seg_{i}.wav by LIST INDEX while the regen allow-list + fingerprints were keyed
by STABLE id. After a delete/merge/split (ids preserved, positions shifted),
unchanged segments reused a different segment's audio → silently corrupted dub
output on the default in-UI incremental path.
- core.config.dub_seg_path(job_id, seg_id): per-segment path keyed by stable
id, sanitized to a bare filename (defends against path traversal via crafted
ids). A numeric index sanitizes to the legacy seg_{i}.wav, so old jobs resolve
through the same helper.
- dub_generate: write/reload per-segment WAVs by stable seg_id (deferred write,
RVC write, regen reload) with a legacy seg_{i}.wav fallback; persist a
job['seg_order'] manifest (index -> stable id) for index-keyed readers.
- dub_export: preview + stems-zip resolve the file via seg_order (-> stable id)
with legacy fallback, so they keep finding the right audio.
- test: dub_seg_path id-naming, legacy-index equivalence, traversal sanitization.
Back-compatible with in-flight jobs (legacy index files still resolve). Closes#185.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(dub): harden dub_seg_path with realpath containment; route all seg paths through it (CodeQL path-injection)
Both job_id and seg_id are request-derived. Sanitise both and verify the
resolved path stays inside DUB_DIR (realpath + startswith) — raises on escape.
Route the legacy index fallbacks in dub_generate/dub_export through dub_seg_path
so no raw os.path.join(DUB_DIR, job_id, ...) remains and a bare '..' component
can't traverse.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(dub): assert path containment at export sinks (recognized CodeQL barrier)
dub_seg_path already validates realpath containment, but CodeQL doesn't
propagate the barrier across the call. Re-assert at the FileResponse / zf.write
sinks (realpath + startswith on the value used) so the guard is recognized
in-function — clears the py/path-injection false positives.
* fix(dub): realpath+containment guard before any path sink in export/preview
CodeQL flags os.path.exists/FileResponse/zf.write as path sinks and won't
propagate dub_seg_path's internal guard. Resolve each candidate, realpath it,
and containment-check (startswith DUB_DIR) BEFORE any filesystem access — the
guard now dominates every sink in-function, clearing py/path-injection.
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Palash Debnath