Skip to content

fix(security): 转义 voicebox / step-audio-editx 成功页的请求可控插值（真反射型 XSS） #153

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ReSerendipity merged 1 commit into from
Sep 23, 2026
+27 −12
Merged

fix(security): 转义 voicebox / step-audio-editx 成功页的请求可控插值（真反射型 XSS） #153

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 14 additions & 6 deletions app/integrated_app/routes/generate/step_audio_editx/edit.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@
- 失败：HTMX HTML 错误片段
"""

import html
import logging
import os
import time
Expand Down Expand Up @@ -193,20 +194,27 @@ async def step_audio_editx_edit_endpoint(
return _error_html(request, result.message, status_code=500)

audio_filename = os.path.basename(result.audio_path)
# 这些值全部或部分来自请求（edit_type / edit_info 是表单原文，source_path 由上传
# 文件名派生），此前直接插进 HTML 文本与属性 -> 反射型 XSS。quote=True 同时覆盖
# 属性上下文（data-audio-filename / src / href / download）。
esc_filename = html.escape(audio_filename, quote=True)
esc_source = html.escape(os.path.basename(source_path or ""), quote=True)
esc_edit_type = html.escape(str(edit_type), quote=True)
esc_edit_info = html.escape(edit_info or "(无)", quote=True)
success_html = f"""
<div class="step-audio-editx-result" data-audio-filename="{audio_filename}">
<div class="step-audio-editx-result" data-audio-filename="{esc_filename}">
<div class="result-success">
<p>✅ 音频编辑完成（耗时 {elapsed:.1f}s）</p>
<p>编辑类型: {edit_type}</p>
<p>编辑标签: {edit_info or "(无)"}</p>
<p>参考音频: {os.path.basename(source_path or "")}</p>
<p>编辑类型: {esc_edit_type}</p>
<p>编辑标签: {esc_edit_info}</p>
<p>参考音频: {esc_source}</p>
<p>输出时长: {result.duration:.2f}s</p>
</div>
<audio controls preload="metadata">
<source src="/api/audio/{audio_filename}" type="audio/wav">
<source src="/api/audio/{esc_filename}" type="audio/wav">
您的浏览器不支持音频播放。
</audio>
<a href="/api/audio/{audio_filename}" download="{audio_filename}">
<a href="/api/audio/{esc_filename}" download="{esc_filename}">
下载编辑后的音频
</a>
</div>
Expand Down
19 changes: 13 additions & 6 deletions app/integrated_app/routes/generate/voicebox/convert.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@
3. 点击转换，输出用目标音色重说源内容的音频
"""

import html
import logging
import os
import time
Expand Down Expand Up @@ -183,20 +184,26 @@ async def voicebox_convert_endpoint(

# 构建 HTMX 成功响应
audio_filename = os.path.basename(result.audio_path)
# 同 step_audio_editx/edit.py：audio_filename / 两个 basename / tau 均可被请求侧
# 影响（上传文件名、表单值），此前直接插进 HTML 文本与属性 -> 反射型 XSS。
esc_filename = html.escape(audio_filename, quote=True)
esc_source = html.escape(os.path.basename(source_path or ""), quote=True)
esc_target = html.escape(os.path.basename(target_path or ""), quote=True)
esc_tau = html.escape(str(tau), quote=True)
success_html = f"""
<div class="voicebox-result" data-audio-filename="{audio_filename}">
<div class="voicebox-result" data-audio-filename="{esc_filename}">
<div class="result-success">
<p>✅ 音色转换完成（耗时 {elapsed:.1f}s）</p>
<p>源音频: {os.path.basename(source_path or "")}</p>
<p>目标音色: {os.path.basename(target_path or "")}</p>
<p>转换强度 (tau): {tau}</p>
<p>源音频: {esc_source}</p>
<p>目标音色: {esc_target}</p>
<p>转换强度 (tau): {esc_tau}</p>
<p>输出时长: {result.duration:.2f}s</p>
</div>
<audio controls preload="metadata">
<source src="/api/audio/{audio_filename}" type="audio/wav">
<source src="/api/audio/{esc_filename}" type="audio/wav">
您的浏览器不支持音频播放。
</audio>
<a href="/api/audio/{audio_filename}" download="{audio_filename}">
<a href="/api/audio/{esc_filename}" download="{esc_filename}">
下载转换后的音频
</a>
</div>
Expand Down
Loading