🛡️ Sentinel: [CRITICAL/HIGH] projectId 경로 조작(Path Traversal) 취약점 수정

.jules/sentinel.md

@@ -28,3 +28,7 @@
 **Vulnerability:** The Rust backend (`apps/desktop/src-tauri/src/main.rs`) did not enforce a maximum URL length limit when processing YouTube URLs via `import_youtube_url`. While the frontend enforced `MAX_YOUTUBE_URL_LENGTH = 2000` via the input element, this could be bypassed by an attacker sending requests directly to the Tauri backend API, potentially causing a Denial of Service (DoS) due to unbounded URL parsing and regex matching.
 **Learning:** Input validation must occur at the entry point of untrusted data on the backend, even if it is also validated on the frontend. Relying solely on frontend validation for constraints like string length can expose the backend to resource exhaustion vulnerabilities.
 **Prevention:** Always enforce constraints like maximum length, format validation, and sanitization at the earliest possible point on the backend, typically at the API boundary, regardless of frontend safeguards.
+## 2025-10-24 - Project ID path traversal guard validation approach
+**Vulnerability:** Any project identifier that can reach a filesystem path join must be treated as untrusted.
+**Learning:** Checking for substrings like `..` can erroneously block legitimate inputs like `my..id`.
+**Prevention:** When validating identifiers like `projectId`, reject exact matches for `.` and `..`, and block any path separators (`/` and `\`), rather than blocking any string containing `..`.

services/analysis-engine/pyproject.toml

@@ -12,8 +12,9 @@ dependencies = [
     "librosa>=0.11.0",
     "numba<0.67.0",
     "numpy>=1.26",
+    "setuptools>=83.0.0",
     "soundfile>=0.13.1",
-            "urllib3>=2.7.0",
+    "urllib3>=2.7.0",
     "yt-dlp>=2026.6.9",
 ]
 

services/analysis-engine/src/bandscope_analysis/api.py

@@ -278,6 +278,9 @@ def validate_analysis_job_request(payload: object) -> AnalysisJobRequest:
 
     if not isinstance(project_id, str) or not project_id.strip():
         raise ValueError("Invalid analysis job request: invalid field 'projectId'")
+    if project_id in {".", ".."} or "/" in project_id or "\\" in project_id:
+        logger.warning("Security: path traversal detected in projectId")
+        raise ValueError("Invalid analysis job request: path traversal detected in 'projectId'")
     if local_source is None:
         raise ValueError("Invalid analysis job request: invalid field 'localSource'")
     if not isinstance(local_source, dict):

services/analysis-engine/tests/test_api.py

@@ -55,7 +55,7 @@ def test_validate_analysis_job_request_accepts_local_audio_payload() -> None:
     assert validate_analysis_job_request(
         {
             "sourceKind": "local_audio",
-            "projectId": "project-1",
+            "projectId": "my..project",
             "sourceLabel": "late-night-set.wav",
             "roleFocus": ["bass-guitar", "lead-vocal"],
             "localSource": {
@@ -69,7 +69,7 @@ def test_validate_analysis_job_request_accepts_local_audio_payload() -> None:
         }
     ) == {
         "sourceKind": "local_audio",
-        "projectId": "project-1",
+        "projectId": "my..project",
         "sourceLabel": "late-night-set.wav",
         "roleFocus": ["bass-guitar", "lead-vocal"],
         "localSource": {
@@ -308,6 +308,51 @@ def test_validate_analysis_job_request_rejects_bad_payloads() -> None:
             },
             "path traversal",
         ),
+        (
+            {
+                "sourceKind": "local_audio",
+                "projectId": "..",
+                "sourceLabel": "Late Night Set",
+                "roleFocus": [],
+                "localSource": {
+                    "sourcePath": "/tmp/a.wav",
+                    "fileName": "a.wav",
+                    "extension": "wav",
+                    "fileSizeBytes": 1024000,
+                },
+            },
+            "path traversal detected in 'projectId'",
+        ),
+        (
+            {
+                "sourceKind": "local_audio",
+                "projectId": "foo/bar",
+                "sourceLabel": "Late Night Set",
+                "roleFocus": [],
+                "localSource": {
+                    "sourcePath": "/tmp/a.wav",
+                    "fileName": "a.wav",
+                    "extension": "wav",
+                    "fileSizeBytes": 1024000,
+                },
+            },
+            "path traversal detected in 'projectId'",
+        ),
+        (
+            {
+                "sourceKind": "local_audio",
+                "projectId": "foo\\bar",
+                "sourceLabel": "Late Night Set",
+                "roleFocus": [],
+                "localSource": {
+                    "sourcePath": "/tmp/a.wav",
+                    "fileName": "a.wav",
+                    "extension": "wav",
+                    "fileSizeBytes": 1024000,
+                },
+            },
+            "path traversal detected in 'projectId'",
+        ),
     ]
 
     for payload, message in cases: