Evil0ctal 969686b1ce fix(transcriber): write the path and log checks in shapes CodeQL accepts ...

Code scanning on the PR reported two path-injection and four
log-injection alerts in the sidecar; main has none open. None was
exploitable - the path was resolved and checked with relative_to, and
the logged ids are pattern-checked by the request model - but each
check was in a form the analyzer does not recognise as a sanitizer:

- _media_file now normalizes with realpath and checks the root prefix,
  the shape the query documents. Symlinks still resolve before the
  check, so a link out of the root is still refused.
- Request fields reach log lines through _loggable, which turns line
  breaks into spaces.

2026-10-16 07:14:07 -07:00

..

app.py

fix(transcriber): write the path and log checks in shapes CodeQL accepts

2026-10-16 07:14:07 -07:00

requirements.txt

fix(transcriber): stop cancelled work, bound decode, pin the image

2026-10-16 02:29:26 -07:00