security(transcriber): fix arbitrary file read vulnerability in RecordingCreate API #9214

Priority

CRITICAL - Path injection vulnerability allows arbitrary file system access

Context

Post-MVA-2186 security review flagged critical path injection in transcriber API.

Vulnerability

POST /api/transcriber/recordings accepts client-provided file_path parameter which is passed directly to FFmpeg and speech providers without validation:

class RecordingCreate(BaseModel):
    filename: str
    file_path: str  # ← client-controlled, no validation

# Passed directly to system commands:
await self.ffmpeg_service.extract_audio(
    input_path=recording.file_path,  # ← attacker-controlled
    output_path=tmp_wav_path
)

Attack vector: Client submits {"filename": "test.wav", "file_path": "/etc/passwd"} → backend reads arbitrary files.

Required Fixes

1. Remove file_path from RecordingCreate - do NOT accept paths from clients
2. Implement authenticated file upload endpoint with multipart/form-data
3. Server-managed paths - generate UUID filenames in per-user upload directory
4. Path validation before any subprocess:
   • Path(p).resolve() and assert within upload dir
   • Reject symlinks
   • Check os.path.isabs() and reject relative paths
5. FFmpeg hardening:
   • Add -protocol_whitelist file to block HLS/HTTP demuxers
   • Add -allowed_extensions wav,mp3,mp4,m4a
   • Pin demuxer with -f flag
6. Consider worker isolation - chroot or privilege dropping

Files

• autobot-backend/api/transcriber.py
• autobot-backend/transcriber/models.py
• autobot-backend/transcriber/orchestrator.py
• autobot-backend/media/audio/ffmpeg_service.py

Reference

• CWE-22: Improper Limitation of a Pathname to a Restricted Directory
• CWE-73: External Control of File Name or Path
• MVA-2186 (original implementation)