Palash DebnathandClaude Opus 4.8
7d9338bd2d
* fix(dub): key per-segment WAVs by stable id, not list index (#185) Partial regeneration ('regenerate only changed segments') reloaded/wrote seg_{i}.wav by LIST INDEX while the regen allow-list + fingerprints were keyed by STABLE id. After a delete/merge/split (ids preserved, positions shifted), unchanged segments reused a different segment's audio → silently corrupted dub output on the default in-UI incremental path. - core.config.dub_seg_path(job_id, seg_id): per-segment path keyed by stable id, sanitized to a bare filename (defends against path traversal via crafted ids). A numeric index sanitizes to the legacy seg_{i}.wav, so old jobs resolve through the same helper. - dub_generate: write/reload per-segment WAVs by stable seg_id (deferred write, RVC write, regen reload) with a legacy seg_{i}.wav fallback; persist a job['seg_order'] manifest (index -> stable id) for index-keyed readers. - dub_export: preview + stems-zip resolve the file via seg_order (-> stable id) with legacy fallback, so they keep finding the right audio. - test: dub_seg_path id-naming, legacy-index equivalence, traversal sanitization. Back-compatible with in-flight jobs (legacy index files still resolve). Closes #185. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(dub): harden dub_seg_path with realpath containment; route all seg paths through it (CodeQL path-injection) Both job_id and seg_id are request-derived. Sanitise both and verify the resolved path stays inside DUB_DIR (realpath + startswith) — raises on escape. Route the legacy index fallbacks in dub_generate/dub_export through dub_seg_path so no raw os.path.join(DUB_DIR, job_id, ...) remains and a bare '..' component can't traverse. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(dub): assert path containment at export sinks (recognized CodeQL barrier) dub_seg_path already validates realpath containment, but CodeQL doesn't propagate the barrier across the call. Re-assert at the FileResponse / zf.write sinks (realpath + startswith on the value used) so the guard is recognized in-function — clears the py/path-injection false positives. * fix(dub): realpath+containment guard before any path sink in export/preview CodeQL flags os.path.exists/FileResponse/zf.write as path sinks and won't propagate dub_seg_path's internal guard. Resolve each candidate, realpath it, and containment-check (startswith DUB_DIR) BEFORE any filesystem access — the guard now dominates every sink in-function, clearing py/path-injection. --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
37 lines
1.5 KiB
Python
37 lines
1.5 KiB
Python
"""dub_seg_path — stable-id-keyed per-segment WAV path (#185).
|
|
|
|
Assert on the filename + job dir (invariants), not the absolute DUB_DIR — other
|
|
tests reload core.config against a fixture data dir, so the module-level DUB_DIR
|
|
constant can differ from the instance dub_seg_path closes over.
|
|
"""
|
|
import os
|
|
|
|
import pytest
|
|
|
|
from core.config import dub_seg_path
|
|
|
|
|
|
def test_keys_by_stable_id():
|
|
assert os.path.basename(dub_seg_path("job1", "5")) == "seg_5.wav"
|
|
# A bare numeric index sanitises to the legacy seg_{i}.wav name, so old jobs
|
|
# keep resolving through the same helper.
|
|
assert os.path.basename(dub_seg_path("job1", 5)) == "seg_5.wav"
|
|
# A stable id that is NOT the current index maps to its own file (the fix).
|
|
assert os.path.basename(dub_seg_path("job1", "abc-12")) == "seg_abc-12.wav"
|
|
# Lives under the job's own directory.
|
|
assert os.path.basename(os.path.dirname(dub_seg_path("job1", "5"))) == "job1"
|
|
|
|
|
|
def test_sanitises_against_path_traversal():
|
|
p = dub_seg_path("job1", "../../etc/passwd")
|
|
assert os.path.basename(p) == "seg_.._.._etc_passwd.wav" # slashes neutralised
|
|
assert os.path.basename(os.path.dirname(p)) == "job1" # stays in the job dir
|
|
assert os.path.basename(dub_seg_path("job1", "a b/c")) == "seg_a_b_c.wav"
|
|
|
|
|
|
def test_rejects_parent_dir_job_id():
|
|
# A bare ".." component survives sanitisation (dots are allowed) but the
|
|
# realpath containment guard rejects it.
|
|
with pytest.raises(ValueError):
|
|
dub_seg_path("..", "5")
|