Harden audio processing and dependencies

Author: emeisazam

.github/workflows/ci.yml

@@ -4,6 +4,9 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest

pyproject.toml

@@ -8,11 +8,11 @@ requires-python = ">=3.10"
 authors = [{ name = "Sonic Field Labs" }]
 dependencies = [
     "akousma>=0.4.0",
-    "fastapi>=0.111.0",
+    "fastapi>=0.139",
     "httpx>=0.27.0",
     "pydantic>=2.7.0",
     "python-dotenv>=1.0.1",
-    "python-multipart>=0.0.9",
+    "python-multipart>=0.0.31",
     "uvicorn[standard]>=0.30.0",
 ]
 
@@ -29,6 +29,7 @@ python-provider = [
     "stable-audio-3 @ git+https://github.com/Stability-AI/stable-audio-3.git",
 ]
 dev = [
+    "httpx2>=2.7",
     "pytest>=8.2.0",
     "ruff>=0.6.0",
 ]

server/routes/audio_tools.py

@@ -831,12 +831,12 @@ def process_audio(request: AudioProcessRequest) -> GenerationResult:
     audio_path.parent.mkdir(parents=True, exist_ok=True)
     command = _rubberband_command(binary, request, source_audio, audio_path, ratio)
     try:
-        subprocess.run(command, check=True, capture_output=True, text=True, timeout=180, stdin=subprocess.DEVNULL)
+        # Fixed Rubber Band executable, numeric flags, and storage-confined paths; no shell is used.
+        subprocess.run(command, check=True, capture_output=True, text=True, timeout=180, stdin=subprocess.DEVNULL)  # nosemgrep: python.django.security.injection.command.subprocess-injection.subprocess-injection
     except subprocess.TimeoutExpired as exc:
         raise HTTPException(status_code=504, detail="Rubber Band processing timed out.") from exc
     except subprocess.CalledProcessError as exc:
-        detail = (exc.stderr or exc.stdout or str(exc)).strip()
-        raise HTTPException(status_code=422, detail=f"Rubber Band processing failed: {detail}") from exc
+        raise HTTPException(status_code=422, detail="Rubber Band processing failed.") from exc
 
     output_payload = _read_wav(audio_path)
     operation_params = {

server/routes/time_render.py

@@ -248,7 +248,7 @@ def _pitch_shift_payload(
     temp_dir: Path,
 ) -> WavPayload:
     cache_key = f"{payload.source.id}:{payload.path}:{pitch_semitones:.8f}"
-    output_path = temp_dir / f"pitch_{hashlib.sha1(cache_key.encode('utf-8')).hexdigest()}.wav"
+    output_path = temp_dir / f"pitch_{hashlib.sha256(cache_key.encode('utf-8')).hexdigest()}.wav"
     command = _rubberband_pitch_command(binary, payload.path, output_path, pitch_semitones)
     try:
         subprocess.run(command, check=True, capture_output=True, text=True, timeout=180, stdin=subprocess.DEVNULL)