Fix path traversal, temp file leak, cross-browser speech, and add tests

server.py

@@ -5,7 +5,7 @@ import whisper
 import os
 import tempfile
 
-app = Flask(__name__, static_folder='.', static_url_path='')
+app = Flask(__name__, static_folder=None)
 CORS(app)
 app.config['MAX_CONTENT_LENGTH'] = 50 * 1024 * 1024  # 50MB max (audio only)
 
@@ -19,19 +19,17 @@ print("Loading Whisper model...")
 model = whisper.load_model("base")
 print("Model loaded!")
 
+ALLOWED_STATIC_FILES = {'index.html', 'app.js'}
+
 @app.route('/')
 def index():
-    response = send_from_directory('.', 'index.html')
-    response.headers['Cross-Origin-Opener-Policy'] = 'same-origin'
-    response.headers['Cross-Origin-Embedder-Policy'] = 'require-corp'
-    return response
+    return send_from_directory('.', 'index.html')
 
 @app.route('/<path:filename>')
 def static_files(filename):
-    response = send_from_directory('.', filename)
-    response.headers['Cross-Origin-Opener-Policy'] = 'same-origin'
-    response.headers['Cross-Origin-Embedder-Policy'] = 'require-corp'
-    return response
+    if filename not in ALLOWED_STATIC_FILES:
+        return jsonify({'error': 'Not found'}), 404
+    return send_from_directory('.', filename)
 
 @app.route('/transcribe', methods=['POST'])
 def transcribe():
@@ -58,8 +56,10 @@ def transcribe():
             filepath = tmp.name
             file.save(filepath)
 
-        result = model.transcribe(filepath, language=language)
-        os.remove(filepath)
+        try:
+            result = model.transcribe(filepath, language=language)
+        finally:
+            os.remove(filepath)
 
         return jsonify({'text': result['text']})
     except Exception as e: