| """Runnable check for the /audio/{name} path-traversal guard: python test_download_name.py""" | |
| import os | |
| import uuid | |
| os.environ.setdefault("API_KEY", "test") | |
| os.environ.setdefault("OUT_DIR", "/tmp/audio-test") | |
| from fastapi import HTTPException | |
| from app import download | |
| def rejected(name): | |
| try: | |
| download(name) | |
| except HTTPException as e: | |
| return e.status_code == 400 | |
| return False | |
| # a real uuid name passes validation (it 404s for a missing file, not 400) | |
| for good in (f"{uuid.uuid4().hex}.wav", f"{uuid.uuid4().hex}.srt"): | |
| assert not rejected(good), good | |
| for bad in [ | |
| "../../etc/passwd", | |
| "../" * 4 + "x.wav", | |
| "/etc/passwd", | |
| "short.wav", | |
| f"{uuid.uuid4().hex}.mp3", | |
| f"{'../a' * 8}.wav", # 36 chars, but not alnum | |
| ]: | |
| assert rejected(bad), bad | |
| print("ok") | |