vince/chatterbox-tts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: tighten voice filename safety plan

Browse source
This commit is contained in:
vince 2026-08-08 23:58:34 +02:00
parent 710139443c
commit 5096e320fe
2 changed files with 12 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

10
docs/superpowers/specs/2026-08-08-voice-studio-design.md
View file

@ -31,11 +31,13 @@ its local-network exposure.
Voice files continue to live exclusively under `VOICES_DIR`.
- `GET /v1/voices` returns safe metadata for each managed file: relative name,
byte size, duration, sample rate, and channel count.
byte size, duration, sample rate, and channel count. It preserves existing
stored filenames rather than renaming them during listing.
- `POST /v1/voices` accepts a multipart `file` upload. The server sanitizes
the filename for storage and display, rejects paths and collisions, accepts
WAV only in this first release, validates that the decoded audio is nonempty,
and saves inside `VOICES_DIR` only.
the filename for storage and display, rejects any path-like name (including
encoded traversal) and collisions, accepts WAV only in this first release,
validates that the decoded audio is nonempty, and saves inside `VOICES_DIR`
only.
- `DELETE /v1/voices/{name}` deletes one validated, regular file below
`VOICES_DIR`; it rejects traversal, absolute paths, symlink escapes, and
missing files.