🛡️ Sentinel: [HIGH] 오디오 분리 모듈 경로 탐색 취약점 수정

[seonghobae]

🚨 심각도: HIGH
💡 취약점: os.path.expanduser() 사용 및 .. 검증 누락으로 인한 잠재적 경로 탐색(Path Traversal) 및 임의 파일 접근 취약점 존재
🎯 영향: 공격자가 악의적으로 조작된 경로를 주입하여 앱 권한을 통해 로컬 시스템의 민감한 파일(예: ~/.ssh/id_rsa, /etc/passwd)에 접근하거나 앱 데이터를 탈취할 수 있음.
🔧 수정 사항:

• services/analysis-engine/src/bandscope_analysis/separation/audio_separator.py 파일 내 _resolve_audio_file 및 _load_model_profile 함수에서 .expanduser() 호출 제거.
• 경로 문자열에 ..가 포함되어 있는지 확인하는 엄격한 방어 로직을 추가하여 ValueError 발생.
• 100% CI 테스트 커버리지를 유지하기 위해 test_separation.py에 경로 탐색 차단 검증 테스트(test_audio_stem_separator_rejects_path_traversal_in_audio_path, test_audio_stem_separator_rejects_path_traversal_in_model_profile) 추가.
• .jules/sentinel.md 저널에 이번 취약점에 대한 핵심 학습 내용 추가 완료.
  ✅ 검증: uv run pytest 및 ./scripts/harness/quickcheck.sh 스크립트를 통해 전체 테스트 및 정적 분석 통과 확인.

---

PR created automatically by Jules for task 11259972245261031002 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[Copilot]

Pull request overview

Hardens the Python analysis-engine’s local stem separation path handling to mitigate flagged path traversal patterns, adds regression tests, and records the security learning in the Sentinel journal.

Changes:

• Removed Path.expanduser() usage for untrusted audio/model-profile paths and added traversal rejection logic.
• Added tests asserting traversal attempts are rejected for both audio paths and model profile overrides.
• Updated .jules/sentinel.md with a short write-up of the vulnerability and prevention approach.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
services/analysis-engine/src/bandscope_analysis/separation/audio_separator.py	Removes expanduser() and adds traversal checks for audio input and optional model profile path.
services/analysis-engine/tests/test_separation.py	Adds regression tests to ensure traversal attempts are rejected early and consistently.
.jules/sentinel.md	Documents the learning/prevention notes for the flagged path handling issue.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[opencode-agent]

OpenCode Review Overview

• Head SHA: dfa0f330184d650e93eec4b5b345f7c2f7bd594f
• Workflow run: 28329046756
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode reviewed the current-head evidence but found unresolved human review threads before approval.

Findings

1. HIGH .github/workflows/opencode-review.yml:1 - Unresolved human review thread blocks automated approval

• Problem: OpenCode reached an APPROVE control result, but the approval step found unresolved, non-outdated human review thread evidence on the current pull request.
• Root cause: Human review feedback can arrive after bounded model evidence is prepared, so the approval step must re-query GitHub immediately before publishing an approval.
• Fix: Address or resolve the listed human review thread(s), then re-run OpenCode on the current head.
• Regression test: Keep the approval gate querying reviewThreads(first: 100) after model output and before create_pull_review APPROVE.

Review thread evidence

Latest unresolved human review thread evidence

services/analysis-engine/src/bandscope_analysis/separation/audio_separator.py line 138

• Latest human comment: @copilot-pull-request-reviewer at 2026-06-26T04:06:50Z
• Comment URL: 🛡️ Sentinel: [HIGH] 오디오 분리 모듈 경로 탐색 취약점 수정 #462 (comment)
• Comment excerpt: The path traversal guard uses a raw substring check (".." in str(audio_path)), which will also reject legitimate filenames containing double-dots (e.g., "take..v2.wav") and does not specifically validate path segments. Consider validating path parts instead so only real parent-directory segments are blocked.

services/analysis-engine/src/bandscope_analysis/separation/audio_separator.py line 226

• Latest human comment: @copilot-pull-request-reviewer at 2026-06-26T04:06:51Z
• Comment URL: 🛡️ Sentinel: [HIGH] 오디오 분리 모듈 경로 탐색 취약점 수정 #462 (comment)
• Comment excerpt: This error raises ValueError with the full, untrusted model profile path embedded in the message. That can leak local directory structure (contradicting the class’ “filename-scoped errors” intent) and can enable log injection if the path contains newlines. Prefer a fixed error string and validate traversal via Path(...).parts (as actual segments) rather than substring matching.

.jules/sentinel.md line 9

• Latest human comment: @copilot-pull-request-reviewer at 2026-06-26T04:06:51Z

• Comment URL: 🛡️ Sentinel: [HIGH] 오디오 분리 모듈 경로 탐색 취약점 수정 #462 (comment)

• Comment excerpt: The Sentinel journal entry is technically misleading: Path.expanduser() expands ~ to the home directory; it doesn’t inherently perform directory traversal. Suggest rewording to focus on “home-directory expansion on untrusted input” and note that traversal prevention should validate path segments (e.g., rejecting .. parts) rather than implying expanduser() itself is traversal.

• Result: REQUEST_CHANGES

• Reason: unresolved human review thread(s) were present before approval.

• Head SHA: dfa0f330184d650e93eec4b5b345f7c2f7bd594f

• Workflow run: 28329046756

• Workflow attempt: 1

Change Flow DAG

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Test: test_separation.py"]
  S2 --> I2["regression suite"]
  I2 --> R2["Review risk: Test: test_separation.py"]
  R2 --> V2["targeted test run"]

Loading

[opencode-agent]

OpenCode reviewed the current-head evidence but found unresolved human review threads before approval.

• Problem: OpenCode reached an APPROVE control result, but the approval step found unresolved, non-outdated human review thread evidence on the current pull request.
• Root cause: Human review feedback can arrive after bounded model evidence is prepared, so the approval step must re-query GitHub immediately before publishing an approval.
• Fix: Address or resolve the listed human review thread(s), then re-run OpenCode on the current head.
• Regression test: Keep the approval gate querying reviewThreads(first: 100) after model output and before create_pull_review APPROVE.

Review thread evidence

Latest unresolved human review thread evidence

services/analysis-engine/src/bandscope_analysis/separation/audio_separator.py line 138

• Latest human comment: @copilot-pull-request-reviewer at 2026-06-26T04:06:50Z
• Comment URL: #462 (comment)
• Comment excerpt: The path traversal guard uses a raw substring check (".." in str(audio_path)), which will also reject legitimate filenames containing double-dots (e.g., "take..v2.wav") and does not specifically validate path segments. Consider validating path parts instead so only real parent-directory segments are blocked.

services/analysis-engine/src/bandscope_analysis/separation/audio_separator.py line 226

• Latest human comment: @copilot-pull-request-reviewer at 2026-06-26T04:06:51Z
• Comment URL: #462 (comment)
• Comment excerpt: This error raises ValueError with the full, untrusted model profile path embedded in the message. That can leak local directory structure (contradicting the class’ “filename-scoped errors” intent) and can enable log injection if the path contains newlines. Prefer a fixed error string and validate traversal via Path(...).parts (as actual segments) rather than substring matching.

.jules/sentinel.md line 9

• Latest human comment: @copilot-pull-request-reviewer at 2026-06-26T04:06:51Z

• Comment URL: #462 (comment)

• Comment excerpt: The Sentinel journal entry is technically misleading: Path.expanduser() expands ~ to the home directory; it doesn’t inherently perform directory traversal. Suggest rewording to focus on “home-directory expansion on untrusted input” and note that traversal prevention should validate path segments (e.g., rejecting .. parts) rather than implying expanduser() itself is traversal.

• Result: REQUEST_CHANGES

• Reason: unresolved human review thread(s) were present before approval.

• Head SHA: 86b548bd68c89146a82d1cb63fe9433a1d4ed0c0

• Workflow run: 28216361303

• Workflow attempt: 1

[seonghobae]

Closing as superseded by #467. #467 carries the same AudioStemSeparator traversal hardening, updated to validate literal parent-directory path components instead of substring-matching '..', with regression tests for valid double-dot filenames/profile names.

[google-labs-jules]

Closing as superseded by #467. #467 carries the same AudioStemSeparator traversal hardening, updated to validate literal parent-directory path components instead of substring-matching '..', with regression tests for valid double-dot filenames/profile names.

Understood. Acknowledging that this work is now superseded by #467 and stopping work on this task.

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head evidence but found unresolved human review threads before approval.

Findings

1. HIGH .github/workflows/opencode-review.yml:1 - Unresolved human review thread blocks automated approval

• Problem: OpenCode reached an APPROVE control result, but the approval step found unresolved, non-outdated human review thread evidence on the current pull request.
• Root cause: Human review feedback can arrive after bounded model evidence is prepared, so the approval step must re-query GitHub immediately before publishing an approval.
• Fix: Address or resolve the listed human review thread(s), then re-run OpenCode on the current head.
• Regression test: Keep the approval gate querying reviewThreads(first: 100) after model output and before create_pull_review APPROVE.

Review thread evidence

Latest unresolved human review thread evidence

services/analysis-engine/src/bandscope_analysis/separation/audio_separator.py line 138

• Latest human comment: @copilot-pull-request-reviewer at 2026-06-26T04:06:50Z
• Comment URL: #462 (comment)
• Comment excerpt: The path traversal guard uses a raw substring check (".." in str(audio_path)), which will also reject legitimate filenames containing double-dots (e.g., "take..v2.wav") and does not specifically validate path segments. Consider validating path parts instead so only real parent-directory segments are blocked.

services/analysis-engine/src/bandscope_analysis/separation/audio_separator.py line 226

• Latest human comment: @copilot-pull-request-reviewer at 2026-06-26T04:06:51Z
• Comment URL: #462 (comment)
• Comment excerpt: This error raises ValueError with the full, untrusted model profile path embedded in the message. That can leak local directory structure (contradicting the class’ “filename-scoped errors” intent) and can enable log injection if the path contains newlines. Prefer a fixed error string and validate traversal via Path(...).parts (as actual segments) rather than substring matching.

.jules/sentinel.md line 9

• Latest human comment: @copilot-pull-request-reviewer at 2026-06-26T04:06:51Z

• Comment URL: #462 (comment)

• Comment excerpt: The Sentinel journal entry is technically misleading: Path.expanduser() expands ~ to the home directory; it doesn’t inherently perform directory traversal. Suggest rewording to focus on “home-directory expansion on untrusted input” and note that traversal prevention should validate path segments (e.g., rejecting .. parts) rather than implying expanduser() itself is traversal.

• Result: REQUEST_CHANGES

• Reason: unresolved human review thread(s) were present before approval.

• Head SHA: dfa0f330184d650e93eec4b5b345f7c2f7bd594f

• Workflow run: 28329046756

• Workflow attempt: 1