feat(S-4): localization 檔案端點上傳硬化（副檔名 + MIME 白名單）#78
Merged
Conversation
localization.py 的 5 個 multipart 端點（translate/image · translate/pdf · meeting/summarize · song/transcribe · dub）原先只把上傳寫進 tempfile，缺 /upload 已有的副檔名 + MIME 白名單。新增共用 _validate_media_upload()：副檔名 強 gate（per 端點媒體類別）+ MIME 寬鬆輔助（octet-stream/空放行、擋明顯非該類）。 dub 走 url 來源不驗。補 tests/test_localization_upload.py 16 測（全 mock 不打 API）。 本機全套 2691 passed（剩 1 QR 像素為容器缺 Noto CJK 字型假象，CI 權威）。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
做什麼
把 S-4「上傳硬化」當初 deferred 的後續小 PR 補上：
server/routes/localization.py的 5 個 multipart 上傳端點全部套上「副檔名 + MIME 白名單」，與主檔案進口POST /upload（S-4 已硬化）一致。translate/imageimage/*translate/pdf.pdfapplication/pdf等meeting/summarizevideo/*audio/*song/transcribevideo/*audio/*dubvideo/*audio/*新增共用 helper
_validate_media_upload()：副檔名為強 gate，MIME 寬鬆輔助（octet-stream/空字串放行＝瀏覽器常見，只擋「有給且明顯非該類」的大類）。為什麼
這 5 個端點原先只把上傳寫進
tempfile.mkstemp（OS 管理路徑、無 path-traversal 風險，故 S-3 audit 評為低風險、本輪未動），但缺 S-4 給/upload的內容類別白名單——任何能連到 server 的人都能往這些端點塞非預期檔案（如.exe/ 文件塞到影音端點）。這是 S-4 文件裡明確標記的 deferred 後續項（「若要一併套白名單可開後續小 PR」）。檔案進
mkstemp不用原檔名，故只驗媒體類別、不另做檔名 sanitize（path 安全由 tempfile 保證，不重複做/upload的 NFC/Windows 保留字處理）。dub走 url 來源時沒有上傳檔，不驗。怎麼測
新增
tests/test_localization_upload.py16 測（全 mock 翻譯/媒體模組，不打真 API、不跑 ffmpeg/whisper）：.exe/文件塞影音端點/無副檔名 → 400octet-stream/空字串放行；矛盾 MIME（.jpg配video/mp4）擋下dub：url 來源不受驗證影響、上傳檔走驗證本機全套 2691 passed（剩 1 個 QR 像素斷言為容器缺 Noto CJK 字型假象，CI 裝字型為權威）。
Reviewer 決策點
無架構抉擇。純防禦性內容類別白名單，行為對既有合法上傳零影響（既有
test_localization_route.py用的合法 png/pdf/mp4 全數仍通過）。未碰 review gate / 狀態機 / runner render 入口。Generated by Claude Code