[liususan091219]

Summary

Path traversal prevention (agent-api.py)

Task IDs and media paths from HTTP requests were used directly in file operations without sanitization. A malicious request like GET /result/../../.env could read arbitrary files outside the intended directory.

• Add _safe_id() that strips all characters except alphanumeric, dash, underscore, dot
• Reject .. and absolute paths in /media/ endpoint before resolving
• Sanitize mime type to prevent HTTP response splitting (newlines in Content-Type header)

Shell injection prevention (inline-tools.ts)

The openUrl and switchApp tools pass user input to osascript via shell. Backslashes were not escaped, allowing crafted input to break out of the quoted string and execute arbitrary shell commands.

• Add backslash escaping before single/double quote escaping

Sensitive data exposure (conversation-server.ts)

The Twilio phone number was logged in cleartext at startup, visible in log files.

• Mask digits in startup log output

XML injection in TwiML (conversation-server.ts)

Meeting IDs and passcodes were interpolated raw into TwiML <Play digits> XML without escaping, allowing XML injection via crafted meeting IDs.

• Apply esc() XML escaping to Play digits attribute

Test plan

• python3 tests/security-sanitization.test.py — 17 assertions passing
• Verify CodeQL alerts resolve after merge — alerts auto-close when CodeQL re-scans on push to main. Check with: gh api repos/sonichi/sutando/code-scanning/alerts --jq '[.[] | select(.state == "open")] | length'

🤖 Generated with Claude Code

[sonichi]

Thorough security hardening — all fixes are correct and introduce no regressions.

Reviewed each fix:

• _safe_id(): Properly strips path traversal chars. Real task IDs (task-*, answer-*, proactive-*) all pass through unchanged.
• /media/ pre-check: Good belt-and-suspenders on top of existing is_relative_to.
• MIME sanitization: Prevents header injection via crafted filenames.
• Shell escaping order fix: Backslashes before quotes — correct.
• TwiML XML escaping: Prevents meeting ID injection into <Play>.
• Phone number masking: Standard PII handling.

Two minor suggestions:

1. Consider adding cleaned.replace('..', '') to _safe_id for extra hardening, even though .. isn't exploitable in current usage.
2. The test file mentioned in the description isn't in the diff — consider committing it.

Ship it.