security: H-2 cookies-path allowlist, H-5 path-traversal, M-1 rate-limit, M-2 security-headers

Closes 4 of 5 Bald-Cluster items from the 2026-05-12 audit. H-3 (Subsonic
plaintext password) is deferred — needs a live Navidrome test setup.

H-2 (High) — yt-dlp cookies_path arbitrary-file-read
  Cookie paths must now live inside config.YOUTUBE_COOKIES_DIR (env-
  overridable, default /app/data), be regular files (symlinks rejected
  before resolve()), and have a .txt/.netscape/.cookies extension.
  The UI-configurable path was the attack surface — even with H-1 fixed
  (non-root container), letting yt-dlp open /app/data/jobs.db as cookie
  file would surface DB contents in yt-dlp error messages.

H-5 (High) — Path-traversal in MP3 target paths
  _sanitize_path and _sanitize_filename now replace ".." sequences and
  strip leading dots BEFORE the char-blacklist. The blacklist removed
  slashes but left the two dots, so an album="../../etc" survived and
  mkdir(parents=True) climbed out of the Navidrome music root.
  Defense-in-depth: containment-check via Path.resolve().relative_to(
  library_root) in get_target_path before mkdir — catches future
  sanitize gaps or callers that bypass _sanitize_path.

M-1 (Medium) — Bulk-endpoint rate limits
  Custom in-memory sliding-window limiter in utils/rate_limit.py. Per
  (client_ip, route) deque with timestamp-based cleanup. Decisions:
  - Custom over slowapi: slowapi requires `request: Request` as first
    endpoint arg, would shadow the existing Pydantic body params and
    force a body-rename across all four target endpoints
  - Key uses utils.auth.client_ip (= the H-7 trusted-proxy-aware
    helper from 03d24f7), so traffic through Traefik isn't collapsed
    onto the proxy IP
  Limits: csv-import 20/h, spotify-history 10/h, url-download 60/h,
  track-download 120/h. Track-download deliberately the highest because
  it's UI-click-driven (e.g. album with 30 tracks = 30 fast clicks).

M-2 (Medium) — Security headers middleware
  Four no-brainer headers via FastAPI HTTP middleware:
  - X-Content-Type-Options: nosniff
  - X-Frame-Options: DENY
  - Referrer-Policy: strict-origin-when-cross-origin
  - Permissions-Policy (geolocation/microphone/camera/payment/usb = ())
  CSP intentionally left out — would break SvelteKit inline-styles and
  the album-art img-src would need to thread through ALBUM_ART_ALLOWED_HOSTS.
  Worth its own tuning pass and follow-up commit.
  HSTS left to the TLS-terminating reverse proxy (Traefik typically
  handles this with its own Headers middleware).

New env var: YOUTUBE_COOKIES_DIR (default /app/data) for H-2.

py_compile clean across all touched files.

Refs:
- ~/SecondBrain/10-Projects/Tonus/security-audit-2026-05-12.md
- v0.4.0 was the Sofort-Cluster (8b01746)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: madmax1301

CHANGELOG.md

@@ -10,6 +10,48 @@ On a `git tag -a vX.Y.Z`, move the relevant entries into a new dated section.
 
 ---
 
+## [0.4.1] — 2026-05-12
+
+Security-Patch — closes 4 of 5 items from the **Bald-Cluster** of the
+2026-05-12 audit. **H-3** (Subsonic plaintext password) is deferred
+because it needs a live Navidrome test environment.
+
+### Security
+
+- **H-2 (High)** — yt-dlp `cookies_path` arbitrary-file-read blocked.
+  Cookie paths must now live inside `config.YOUTUBE_COOKIES_DIR`
+  (env-overridable, default `/app/data`), be regular files (no symlinks
+  followed), and have a `.txt` / `.netscape` / `.cookies` extension.
+  Configurable via *Settings → Verbindungen* but with hard guard-rails.
+- **H-5 (High)** — Path-traversal in MP3 target paths fixed.
+  `_sanitize_path` and `_sanitize_filename` now replace `..` sequences
+  and strip leading dots BEFORE the char-blacklist. Plus defense-in-depth
+  containment check via `Path.resolve().relative_to(library_root)` in
+  `get_target_path` before `mkdir`.
+- **M-1 (Medium)** — Bulk-Endpoint rate limits added: CSV-Import 20/h,
+  Spotify-History 10/h, URL-Download 60/h, Track-Download 120/h. Sliding-
+  window counter per `(client_ip, route)`, uses the H-7 trusted-proxy-aware
+  `client_ip` helper (no Reverse-Proxy collapsing onto the proxy IP).
+- **M-2 (Medium)** — Security headers middleware: `X-Content-Type-Options:
+  nosniff`, `X-Frame-Options: DENY`, `Referrer-Policy:
+  strict-origin-when-cross-origin`, `Permissions-Policy`. CSP intentionally
+  deferred — would break SvelteKit inline-styles without a tuning pass.
+
+### Pending
+
+- **H-3 (High)** — Subsonic plaintext password. Refactor to Subsonic
+  Token-Auth (`?u=user&s=salt&t=md5(password+salt)`) requires a live
+  Navidrome instance for verification. Tracked in the SecondBrain audit
+  doc.
+
+### New env vars
+
+| Var | Default | Purpose |
+|---|---|---|
+| `YOUTUBE_COOKIES_DIR` | `/app/data` | H-2: allowed root for `YOUTUBE_COOKIES_PATH` |
+
+---
+
 ## [0.4.0] — 2026-05-12
 
 Security-Hardening-Release. Closes the entire **Sofort-Fix-Cluster** from the

backend/app.py

@@ -59,9 +59,19 @@
 )
 from utils.worker import JobWorker
 from utils.auth import require_token, require_admin, auth_required, optional_token
+from utils.rate_limit import make_rate_limiter
 
 ALLOWED_METADATA_PROVIDERS = frozenset({"deezer", "spotify"})
 
+# Rate-Limiter (Audit M-1, 2026-05-12). Module-level damit alle Requests
+# denselben State teilen — Fresh-Per-Request würde den Counter resetten.
+# Werte konservativ-großzügig gewählt: legitime Bulk-User stoßen nicht an,
+# automatisierte Bursts werden gebremst.
+_rl_csv_import = make_rate_limiter(20, 3600)        # 20 CSV-Imports/h
+_rl_spotify_history = make_rate_limiter(10, 3600)   # 10 Spotify-History/h
+_rl_url_download = make_rate_limiter(60, 3600)      # 60 URL-Downloads/h
+_rl_track_download = make_rate_limiter(120, 3600)   # 120 Track-Downloads/h
+
 # Extra download attempts after the first failure (each failure waits before retrying).
 MAX_DOWNLOAD_RETRIES_CAP = 5
 
@@ -876,6 +886,30 @@ async def add_root_path(request: Request, call_next):
     return await call_next(request)
 
 
+@app.middleware("http")
+async def add_security_headers(request: Request, call_next):
+    """Standard-Security-Header für jede Response (Audit M-2, 2026-05-12).
+
+    Vier No-Brainer-Header die nicht die UI brechen können:
+      - X-Content-Type-Options: nosniff — blockt MIME-Type-Sniffing-Attacks
+      - X-Frame-Options: DENY — blockt Clickjacking via iframe-Embedding
+      - Referrer-Policy: strict-origin-when-cross-origin — limitiert Referer-Leak
+      - Permissions-Policy — disabled Browser-APIs die Tonus nicht braucht
+    CSP bleibt bewusst weg — würde SvelteKit-inline-styles brechen und braucht
+    eigenes Tuning (eigenes Backlog-Item). HSTS macht Sinn nur HINTER TLS-Proxy
+    (Traefik) und wird vom Proxy selbst gesetzt — hier kein zweites Set.
+    """
+    response = await call_next(request)
+    response.headers.setdefault("X-Content-Type-Options", "nosniff")
+    response.headers.setdefault("X-Frame-Options", "DENY")
+    response.headers.setdefault("Referrer-Policy", "strict-origin-when-cross-origin")
+    response.headers.setdefault(
+        "Permissions-Policy",
+        "geolocation=(), microphone=(), camera=(), payment=(), usb=()",
+    )
+    return response
+
+
 @app.get("/api/metadata/providers")
 async def metadata_providers():
     """Available metadata sources and server default."""
@@ -1294,7 +1328,7 @@ async def move_queue_item(req: QueueMoveRequest, _: None = Depends(require_token
 
 
 @app.post("/api/download")
-async def download_track(request: DownloadRequest, background_tasks: BackgroundTasks, _: None = Depends(require_token)):
+async def download_track(request: DownloadRequest, background_tasks: BackgroundTasks, _: None = Depends(require_token), __: None = Depends(_rl_track_download)):
     """Start downloading a track"""
     if request.location not in ["local", "navidrome"]:
         request.location = "local"
@@ -2116,7 +2150,7 @@ def get_recommendations(request: RecommendationRequest):
 
 
 @app.post("/api/import/csv")
-async def import_csv(request: CsvImportRequest, _: None = Depends(require_token)):
+async def import_csv(request: CsvImportRequest, _: None = Depends(require_token), __: None = Depends(_rl_csv_import)):
     """
     CSV-Import (persistent): speichert Job in SQLite, Worker holt ihn ab.
     Gibt sofort eine job_id zurück — Status unter /api/import/jobs/{job_id}/status pollbar.
@@ -2316,7 +2350,7 @@ class SpotifyHistoryImportRequest(BaseModel):
 
 
 @app.post("/api/import/spotify-history")
-async def import_spotify_history(req: SpotifyHistoryImportRequest, _: None = Depends(require_token)):
+async def import_spotify_history(req: SpotifyHistoryImportRequest, _: None = Depends(require_token), __: None = Depends(_rl_spotify_history)):
     """Importiert eine oder mehrere Spotify-Extended-Streaming-History-JSONs.
 
     Pipeline-Integration:
@@ -2879,7 +2913,7 @@ def url_download_and_process(
 
 
 @app.post("/api/url/download")
-async def url_download(req: URLDownloadRequest, background_tasks: BackgroundTasks, _: None = Depends(require_token)):
+async def url_download(req: URLDownloadRequest, background_tasks: BackgroundTasks, _: None = Depends(require_token), __: None = Depends(_rl_url_download)):
     """Phase 1: Direkter Download via URL ohne Spotify/Deezer-Match.
 
     Funktioniert für YouTube, SoundCloud, Bandcamp, Vimeo … alles was yt-dlp kennt.

backend/config.py

@@ -86,6 +86,16 @@ def navidrome_libraries_public() -> List[Dict[str, Any]]:
 # YouTube Configuration
 YOUTUBE_COOKIES_PATH = os.getenv("YOUTUBE_COOKIES_PATH", "")  # Path to YouTube cookies file (Netscape format) for yt-dlp
 
+# H-2 Audit 2026-05-12: Allowed-Root für YOUTUBE_COOKIES_PATH.
+# yt-dlp liest die Cookies-Datei direkt von Disk. Ohne Restriction konnte
+# der Operator via Settings → Verbindungen einen beliebigen Pfad eintragen
+# (z.B. /etc/passwd oder /app/data/jobs.db) — yt-dlp würde versuchen die
+# Datei als Cookies-Netscape-Format zu parsen. Kombiniert mit H-1 (Container
+# als root) wäre das ein arbitrary-file-read; H-1 ist gefixt, dies hier ist
+# defense-in-depth. Bind-Mount-Konvention: Operator legt die Cookies-Datei
+# in das App-Daten-Volume, das standardmäßig auf /app/data gemountet wird.
+YOUTUBE_COOKIES_DIR = os.getenv("YOUTUBE_COOKIES_DIR", "/app/data")
+
 # yt-dlp Anti-Detection / Rate-Limiting
 # ratelimit: Bytes/sec für jeden einzelnen Download. 1.5 MB/s ist fast nie
 #   für die User wahrnehmbar (3-min Track in 12 s) und reduziert das Profil

backend/services/navidrome.py

@@ -470,6 +470,22 @@ def get_target_path(self, track_info: Dict, file_extension: str, library_root: O
 
         # Create directory: <root>/Artist/Album/
         target_dir = self._library_root(library_root) / artist_name / album_name
+
+        # H-5 defense-in-depth: containment-check VOR mkdir. Die sanitize-
+        # Steps oben sollten Traversal eigentlich verhindern — der check
+        # fängt zukünftige Sanitize-Lücken oder Caller die _sanitize_path
+        # umgehen ab. relative_to raised ValueError wenn target_dir nicht
+        # innerhalb library_root liegt.
+        root_resolved = self._library_root(library_root).resolve()
+        target_resolved = target_dir.resolve()
+        try:
+            target_resolved.relative_to(root_resolved)
+        except ValueError:
+            raise ValueError(
+                f"Path-traversal blocked (Audit H-5): target {target_resolved} "
+                f"outside library root {root_resolved}"
+            )
+
         target_dir.mkdir(parents=True, exist_ok=True)
 
         # Build filename
@@ -577,22 +593,29 @@ def _trigger_scan(self) -> bool:
             return False
 
     def _sanitize_path(self, path: str) -> str:
-        """Remove invalid characters from path"""
+        """Remove invalid characters from path; block path-traversal (Audit H-5).
+
+        Strippt erst dotdot-Sequenzen und führende Dots, dann die Standard-
+        Zeichen-Blacklist. Ohne den dotdot-Fix konnte ein Track mit
+        ``album="../../etc"`` per ``root/artist/<traversed>`` außerhalb der
+        Library landen — die Blacklist entfernte zwar den Slash, aber die
+        zwei Punkte blieben, und mkdir hat sie als parent-traversal akzeptiert.
+        """
         import re
-        # Remove invalid characters
+        path = path.replace("..", "_")
+        path = path.lstrip(".")
         path = re.sub(r'[<>:"/\\|?*]', '', path)
-        # Replace multiple spaces with single space
         path = re.sub(r'\s+', ' ', path)
-        # Trim
-        return path.strip()
-    
+        result = path.strip()
+        return result or "_"
+
     def _sanitize_filename(self, filename: str) -> str:
-        """Remove invalid characters from filename"""
+        """Remove invalid characters from filename; block path-traversal (Audit H-5)."""
         import re
-        # Remove invalid characters
+        filename = filename.replace("..", "_")
+        filename = filename.lstrip(".")
         filename = re.sub(r'[<>:"/\\|?*]', '', filename)
-        # Replace multiple spaces with single space
         filename = re.sub(r'\s+', ' ', filename)
-        # Trim
-        return filename.strip()
+        result = filename.strip()
+        return result or "_"
 

backend/services/youtube.py

@@ -246,12 +246,40 @@ def _resolve_downloaded_audio(
         return None
 
     def _add_cookies_to_opts(self, ydl_opts: Dict) -> Dict:
-        """Add cookies to yt-dlp options if configured."""
-        if self.cookies_path and os.path.exists(self.cookies_path):
-            ydl_opts['cookiefile'] = self.cookies_path
-            print(f"Using YouTube cookies from: {self.cookies_path}")
-        elif self.cookies_path:
+        """Add cookies to yt-dlp options if configured AND path-validated (Audit H-2).
+
+        Vier Validation-Stufen vor dem ``cookiefile``-Inject:
+          1. Pfad existiert
+          2. Pfad ist eine reguläre Datei (kein Symlink — sonst könnte ein
+             Symlink-in-Cookies-Dir auf ``/etc/passwd`` zeigen)
+          3. Extension ∈ {.txt, .netscape, .cookies} — yt-dlp erwartet
+             Netscape-Format, andere Files werden silently rejected
+          4. Resolved-Path liegt innerhalb von ``config.YOUTUBE_COOKIES_DIR``
+             — verhindert arbitrary-file-read über UI-konfigurierbaren Pfad
+        Bei Failure: Warning-Print + Skip (kein Throw, damit Resolver weiter
+        läuft auch wenn Cookie-File misconfiguriert ist).
+        """
+        if not self.cookies_path:
+            return ydl_opts
+        cp = Path(self.cookies_path)
+        if not cp.exists():
             print(f"Warning: Cookie file specified but not found: {self.cookies_path}")
+            return ydl_opts
+        if cp.is_symlink() or not cp.is_file():
+            print(f"Warning: Cookie path is symlink or not a regular file (H-2 reject): {self.cookies_path}")
+            return ydl_opts
+        if cp.suffix.lower() not in (".txt", ".netscape", ".cookies"):
+            print(f"Warning: Cookie file extension not in whitelist (H-2 reject): {self.cookies_path}")
+            return ydl_opts
+        try:
+            root_resolved = Path(config.YOUTUBE_COOKIES_DIR).resolve()
+            cookies_resolved = cp.resolve()
+            cookies_resolved.relative_to(root_resolved)
+        except (ValueError, OSError):
+            print(f"Warning: Cookie path outside YOUTUBE_COOKIES_DIR={config.YOUTUBE_COOKIES_DIR} (H-2 reject): {self.cookies_path}")
+            return ydl_opts
+        ydl_opts['cookiefile'] = str(cookies_resolved)
+        print(f"Using YouTube cookies from: {self.cookies_path}")
         return ydl_opts
 
     def calculate_similarity(self, str1: str, str2: str) -> float:

backend/utils/rate_limit.py

@@ -0,0 +1,69 @@
+"""In-Memory Rate-Limiter als FastAPI-Dependency (Audit M-1, 2026-05-12).
+
+Sliding-Window-Counter pro (client_ip, route) — verhindert DoS-Bursts und
+Quota-Burn auf den Bulk-Endpoints (CSV-Import, Spotify-History-Import, URL-
+Download, Track-Download). Nutzt die ``utils.auth.client_ip``-Helper mit dem
+H-7 trusted-proxy-Check, damit Bans nicht auf der Reverse-Proxy-IP collapsieren
+(slowapi's eingebauter ``get_remote_address`` würde das tun).
+
+Design-Notes
+------------
+* **In-Memory, kein Redis** — Tonus läuft typisch als Single-Container; eine
+  Process-Restart leert den State, was bei einem Patch-Deploy gewünscht ist
+  ("frischer Limit-Counter nach Restart, kein hängender Ban").
+* **deque mit pop-from-left** — O(1) für append + O(k) für Expiry-Cleanup,
+  k = Anzahl entfernter alter Einträge. Klassisches Sliding-Window-Pattern.
+* **Bounded Memory** — wenn ein Client nichts mehr macht, leert sich seine
+  Deque automatisch beim nächsten Request derselben IP+Route, weil alle
+  Timestamps älter als Window sind und gepopt werden.
+* **Per-Route-Key** — selbe IP kann gleichzeitig nahe am CSV-Import-Limit
+  UND am URL-Download-Limit sein, ohne sich gegenseitig zu blockieren.
+"""
+from __future__ import annotations
+
+import time
+from collections import defaultdict, deque
+from typing import Callable, Deque, Dict
+
+from fastapi import HTTPException, Request, status
+
+
+_rate_limit_state: Dict[str, Deque[float]] = defaultdict(deque)
+
+
+def make_rate_limiter(max_calls: int, window_seconds: int) -> Callable[[Request], None]:
+    """Erzeugt eine FastAPI-Dependency die bei Limit-Exceed 429 throwt.
+
+    Args:
+        max_calls: Maximale Calls pro Window.
+        window_seconds: Window-Größe in Sekunden.
+
+    Returns:
+        Dependency-Funktion, mit ``Depends(...)`` einsetzbar.
+
+    Beispiel:
+        >>> _limit_csv = make_rate_limiter(20, 3600)
+        >>> @app.post("/api/import/csv")
+        ... async def import_csv(req: CsvImportRequest, _: None = Depends(_limit_csv)):
+        ...     ...
+    """
+    from utils.auth import client_ip  # lazy import — vermeidet Circular
+
+    def dep(request: Request) -> None:
+        ip = client_ip(request) or "unknown"
+        key = f"{ip}:{request.url.path}"
+        now = time.time()
+        window = _rate_limit_state[key]
+        # Alte Timestamps aus dem Window-Tail wegpoppen (sliding cleanup)
+        cutoff = now - window_seconds
+        while window and window[0] < cutoff:
+            window.popleft()
+        if len(window) >= max_calls:
+            raise HTTPException(
+                status_code=status.HTTP_429_TOO_MANY_REQUESTS,
+                detail=f"Rate limit exceeded: {max_calls} requests / {window_seconds}s",
+                headers={"Retry-After": str(window_seconds)},
+            )
+        window.append(now)
+
+    return dep