Security: fix path traversal and arbitrary filesystem access vectors; cross-platform test fixes

[Copilot]

User-controlled input could reach the filesystem outside intended boundaries via three distinct vectors. Additionally, hardcoded Unix paths in security tests caused Windows CI failures.

Security fixes

Path traversal in GET /v1/audio

The old sanitization (replace(/\.\./g, "")) is bypassable. Replaced with resolve() + isPathWithin() containment check — any path resolving outside audioStorageDir returns 404.

- const safePath = parsePath(pathParam).replace(/\.\./g, "").replace(/^\/+/, "");
- const filePath = join(config.audioStorageDir, safePath);
+ const requestedPath = parsePath(pathParam).replace(/^\/+/, "");
+ const filePath = resolve(join(config.audioStorageDir, requestedPath));
+ if (!isPathWithin(filePath, config.audioStorageDir)) return detailRes("Not Found", 404);

Arbitrary path access via src_audio_path / reference_audio_path

JSON bodies could supply {"src_audio_path": "/etc/shadow"} and have it forwarded directly to ace-synth --src-audio. Now validated to be within tmpDir (multipart upload landing zone) or audioStorageDir before the binary is invoked.

Arbitrary path access via per-request lm_model_path

Same class of issue — JSON bodies could override the LM model path to any file passed to ace-lm --lm. When ACESTEP_MODELS_DIR is configured, the resolved path must be within that directory.

Shared utility — src/paths.ts

Added isPathWithin(child, parent): resolves both sides with path.resolve(), then checks for exact equality or a sep-terminated prefix. The sep guard prevents /storage/audiovil from matching /storage/audio.

Cross-platform test fixes — test/security.test.ts

Hardcoded Unix paths like "/storage/audio/abc123.mp3" broke Windows CI. Fixed by:

• Deriving storageDir via resolve("/storage/audio") (picks up drive letter on Windows)
• Using join(storageDir, ...) for .toBe() expectations
• Using storageDir + sep for .startsWith() checks

---

📱 Kick off Copilot coding agent tasks wherever you are with GitHub Mobile, available on iOS and Android.