Fix security issues flagged by CodeQL in TTS package

packages/qvac-lib-infer-onnx-tts/benchmarks/python-server/src/chatterbox_runner.py

@@ -173,15 +173,14 @@ def synthesize_batch(self, texts: List[str], include_samples: bool = False) -> D
 
             except Exception as e:
                 logger.error(f"Failed to synthesize text {i+1}: {e}")
-                # Add failed output with error info
                 outputs.append({
                     "text": text,
                     "sampleCount": 0,
                     "sampleRate": sample_rate,
                     "durationSec": 0,
                     "generationMs": 0,
                     "rtf": 0,
-                    "error": str(e)
+                    "error": "Synthesis failed for this input",
                 })
 
         total_gen_ms = (time.perf_counter() - gen_start) * 1000

packages/qvac-lib-infer-onnx-tts/benchmarks/python-server/src/server.py

@@ -37,6 +37,14 @@ def _get_supertonic_runner_class():
 logger = logging.getLogger(__name__)
 
 BENCHMARKS_DIR = os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+_BENCHMARKS_REAL = os.path.realpath(BENCHMARKS_DIR)
+
+
+def _validate_path_within_benchmarks(path: str) -> str:
+    resolved = os.path.realpath(path)
+    if not resolved.startswith(_BENCHMARKS_REAL + os.sep) and resolved != _BENCHMARKS_REAL:
+        raise HTTPException(400, "Path must be within the benchmarks directory")
+    return resolved
 
 app = FastAPI(
     title="TTS Python Native Benchmark Server",
@@ -122,7 +130,7 @@ async def synthesize_chatterbox(request: ChatterboxRequest):
             logger.info("Chatterbox runner initialized")
         except ImportError as e:
             logger.error(f"Failed to initialize Chatterbox runner: {e}")
-            raise HTTPException(500, f"chatterbox-tts not installed: {str(e)}")
+            raise HTTPException(500, "Required dependency chatterbox-tts is not installed")
 
     try:
         logger.info(f"[Chatterbox] Processing {len(request.texts)} texts")
@@ -131,8 +139,10 @@ async def synthesize_chatterbox(request: ChatterboxRequest):
 
         if not chatterbox_runner.is_model_loaded():
             ref_audio_path = request.config.referenceAudioPath
-            if ref_audio_path and not os.path.isabs(ref_audio_path):
-                ref_audio_path = os.path.join(BENCHMARKS_DIR, ref_audio_path)
+            if ref_audio_path:
+                if not os.path.isabs(ref_audio_path):
+                    ref_audio_path = os.path.join(BENCHMARKS_DIR, ref_audio_path)
+                ref_audio_path = _validate_path_within_benchmarks(ref_audio_path)
 
             logger.info(f"[Chatterbox] Loading model on device: {device}")
             chatterbox_runner.load_model(
@@ -158,10 +168,10 @@ async def synthesize_chatterbox(request: ChatterboxRequest):
 
     except ImportError as e:
         logger.error(f"[Chatterbox] Import error: {e}")
-        raise HTTPException(500, f"Chatterbox not installed: {str(e)}")
+        raise HTTPException(500, "Required dependency chatterbox-tts is not installed")
     except Exception as e:
         logger.error(f"[Chatterbox] Synthesis failed: {e}", exc_info=True)
-        raise HTTPException(500, f"Chatterbox synthesis failed: {str(e)}")
+        raise HTTPException(500, "Chatterbox synthesis failed")
 
 
 @app.post("/synthesize-supertonic")
@@ -182,7 +192,7 @@ async def synthesize_supertonic(request: SupertonicRequest):
             logger.error(f"Failed to initialize Supertonic runner: {e}")
             raise HTTPException(
                 500,
-                f"Supertonic dependencies not installed: {str(e)}. "
+                "Supertonic dependencies not installed. "
                 "Install with: pip install -r requirements-supertonic.txt",
             )
 
@@ -192,8 +202,10 @@ async def synthesize_supertonic(request: SupertonicRequest):
         model_dir = request.config.modelDir
         if not model_dir:
             model_dir = os.path.join(BENCHMARKS_DIR, "shared-data", "models", "supertonic")
-        elif not os.path.isabs(model_dir):
-            model_dir = os.path.join(BENCHMARKS_DIR, model_dir)
+        else:
+            if not os.path.isabs(model_dir):
+                model_dir = os.path.join(BENCHMARKS_DIR, model_dir)
+            model_dir = _validate_path_within_benchmarks(model_dir)
 
         if not supertonic_runner.is_model_loaded():
             logger.info(f"[Supertonic] Loading model from: {model_dir}")
@@ -225,7 +237,7 @@ async def synthesize_supertonic(request: SupertonicRequest):
 
     except ImportError as e:
         logger.error(f"[Supertonic] Import error: {e}")
-        raise HTTPException(500, f"Supertonic not installed: {str(e)}")
+        raise HTTPException(500, "Required Supertonic dependencies are not installed")
     except Exception as e:
         logger.error(f"[Supertonic] Synthesis failed: {e}", exc_info=True)
-        raise HTTPException(500, f"Supertonic synthesis failed: {str(e)}")
+        raise HTTPException(500, "Supertonic synthesis failed")

packages/qvac-lib-infer-onnx-tts/benchmarks/python-server/src/supertonic_runner.py

@@ -34,7 +34,7 @@ class _SupertonicTTS:
                 LATENT_SIZE = BASE_CHUNK_SIZE * CHUNK_COMPRESS_FACTOR
 
                 def __init__(self, model_path: str):
-                    self.model_path = os.path.abspath(model_path)
+                    self.model_path = os.path.realpath(model_path)
                     if not os.path.isdir(self.model_path):
                         raise FileNotFoundError(
                             f"Supertonic model directory not found: {self.model_path}"
@@ -246,7 +246,7 @@ def synthesize_batch(
                     "durationSec": 0,
                     "generationMs": 0,
                     "rtf": 0,
-                    "error": str(e),
+                    "error": "Synthesis failed for this input",
                 })
 
         total_gen_ms = (time.perf_counter() - gen_start) * 1000