Fix 400 error on file uploads by allowing server-generated temp paths

[goedzo]

Modified api_server.py to allow absolute paths if they are located within the system's temporary folder. This prevents the security validator from tripping over valid file uploads saved by the server. Path validation for raw string inputs remains strictly enforced at the API entry points.

• Updated _validate_audio_path to whitelist absolute paths residing within the system temp directory.
• Refactored _build_request to stop validating internal arguments that have already been processed.
• Moved explicit path validation to the "edge" (JSON and Form handlers) to ensure untrusted user strings are still strictly checked while trusting server-generated file paths.

Test result of the new code:
INFO: 10.0.0.250:50798 - "POST /release_task HTTP/1.1" 200 OK
2026-02-09 10:43:12.237 | INFO | acestep.handler:_load_model_context:902 - [_load_model_context] Loading vae to cuda
2026-02-09 10:43:13.065 | INFO | acestep.handler:_load_model_context:915 - [_load_model_context] Loaded vae to cuda in 0.8280s
2026-02-09 10:43:13.097 | INFO | acestep.gpu_config:get_gpu_memory_gb:168 - CUDA GPU detected: NVIDIA GeForce RTX 3050 (8.0 GB)
INFO: 10.0.0.250:50814 - "POST /query_result HTTP/1.1" 200 OK
INFO: 10.0.0.250:34166 - "POST /query_result HTTP/1.1" 200 OK
INFO: 10.0.0.250:34182 - "POST /query_result HTTP/1.1" 200 OK
INFO: 10.0.0.250:34194 - "POST /query_result HTTP/1.1" 200 OK
INFO: 10.0.0.250:34210 - "POST /query_result HTTP/1.1" 200 OK
INFO: 10.0.0.250:32928 - "POST /query_result HTTP/1.1" 200 OK
INFO: 10.0.0.250:32934 - "POST /query_result HTTP/1.1" 200 OK
INFO: 10.0.0.250:32940 - "POST /query_result HTTP/1.1" 200 OK
INFO: 10.0.0.250:32946 - "POST /query_result HTTP/1.1" 200 OK
2026-02-09 10:43:29.923 | INFO | acestep.handler:_load_model_context:921 - [_load_model_context] Offloading vae to CPU
2026-02-09 10:43:30.764 | INFO | acestep.handler:_load_model_context:935 - [_load_model_context] Offloaded vae to CPU in 0.8406s
2026-02-09 10:43:30.766 | INFO | acestep.handler:_load_model_context:902 - [_load_model_context] Loading model to cuda
INFO: 10.0.0.250:32958 - "POST /query_result HTTP/1.1" 200 OK
INFO: 10.0.0.250:34816 - "POST /query_result HTTP/1.1" 200 OK
INFO: 10.0.0.250:34830 - "POST /query_result HTTP/1.1" 200 OK
INFO: 10.0.0.250:34846 - "POST /query_result HTTP/1.1" 200 OK
INFO: 10.0.0.250:34848 - "POST /query_result HTTP/1.1" 200 OK
INFO: 10.0.0.250:34850 - "POST /query_result HTTP/1.1" 200 OK
INFO: 10.0.0.250:45600 - "POST /query_result HTTP/1.1" 200 OK
INFO: 10.0.0.250:45606 - "POST /query_result HTTP/1.1" 200 OK
INFO: 10.0.0.250:45612 - "POST /query_result HTTP/1.1" 200 OK
INFO: 10.0.0.250:45620 - "POST /query_result HTTP/1.1" 200 OK
loss_type=None was set in the config but it is unrecognized. Using the default loss: ForCausalLMLoss.
2026-02-09 10:43:50.570 | INFO | acestep.handler:_load_model_context:915 - [_load_model_context] Loaded model to cuda in 19.8038s
INFO: 10.0.0.250:45630 - "POST /query_result HTTP/1.1" 200 OK
2026-02-09 10:43:53.168 | INFO | acestep.handler:convert_src_audio_to_codes:1829 - [convert_src_audio_to_codes] Generated 1164 audio codes
2026-02-09 10:43:53.168 | INFO | acestep.handler:_load_model_context:921 - [_load_model_context] Offloading model to CPU
INFO: 10.0.0.250:53492 - "POST /query_result HTTP/1.1" 200 OK
INFO: 10.0.0.250:53500 - "POST /query_result HTTP/1.1" 200 OK
2026-02-09 10:43:56.003 | INFO | acestep.handler:_load_model_context:935 - [_load_model_context] Offloaded model to CPU in 2.8355s
2026-02-09 10:43:56.013 | INFO | acestep.llm_inference:understand_audio_from_codes:1605 - Understanding audio codes (length: 22985 chars)
formatted_prompt: <|im_start|>system

Instruction

Understand the given musical conditions and describe the audio semantics accordingly:

<|im_end|>
<|im_start|>user
<|audio_code_7118|><|audio_code_10233|><|audio_code_36858|><|audio_code_349|><|audio_code_2372|><|audio_code_53440|><|audio_code_6090|><|audio_code_36289|><|audio_code_38976|><|audio_code_38899|><|audio_code_62953|><|audio_code_53705|><|audio_code_2025|><|audio_code_57537|><|audio_code_2077|><|audio_code_1640|><|audio_code_53505|><|audio_code_1216|><|audio_code_5440|><|audio_code_57681|><|audio_code_51561|><|audio_code_40656|><|audio_code_10588|><|audio_code_2369|><|audio_code_51200|><|audio_code_36096|><|audio_code_44233|><|audio_code_13896|><|audio_code_14762|><|audio_code_17865|><|audio_code_41649|><|audio_code_12201|><|audio_code_25674|><|audio_code_6412|><|audio_code_1025|><|audio_code_128|><|audio_code_25601|><|audio_code_12624|><|audio_code_53569|><|audio_code_333|><|audio_code_58876|><|audio_code_14274|><|audio_code_40189|><|audio_code_50708|><|audio_code_45305|><|audio_code_53604|><|audio_code_58715|><|audio_code_5440|><|audio_code_62796|><|audio_code_51520|><|audio_code_63947|><|audio_code_402|><|audio_code_41216|><|audio_code_14355|><|audio_code_43648|><|audio_code_27648|><|audio_code_13184|><|audio_code_28096|><|audio_code_5074|><|audio_code_13256|><|audio_code_19754|><|audio_code_2767|><|audio_code_2196|><|audio_code_12545|><|audio_code_7489|><|audio_code_43376|><|audio_code_38184|><|audio_code_14275|><|audio_code_61890|><|audio_code_33089|><|audio_code_395|><|audio_code_5962|><|audio_code_2077|><|audio_code_36984|><|audio_code_1763|><|audio_code_38338|><|audio_code_30584|><|audio_code_1401|><|audio_code_36804|><|audio_code_450|><|audio_code_5627|><|audio_code_449|><|audio_code_52224|><|audio_code_2306|><|audio_code_40394|><|audio_code_40008|><|audio_code_36308|><|audio_code_58819|><|audio_code_61923|><|audio_code_10698|><|audio_code_875|><|audio_code_12068|><|audio_code_1080|><|audio_code_12546|><|audio_code_53625|><|audio_code_61384|><|audio_code_7163|><|audio_code_56315|><|audio_code_60385|><|audio_code_5571|><|audio_code_53755|><|audio_code_27144|><|audio_code_11201|><|audio_code_26603|><|audio_code_14544|><|audio_code_20418|><|audio_code_12778|><|audio_code_36298|><|audio_code_60364|><|audio_code_55002|><|audio_code_12779|><|audio_code_57864|><|audio_code_58792|><|audio_code_26153|><|audio_code_12224|><|audio_code_58835|><|audio_code_12746|><|audio_code_56259|><|audio_code_28098|><|audio_code_62734|><|audio_code_9884|><|audio_code_51176|><|audio_code_36331|><|audio_code_8674|><|audio_code_60856|><|audio_code_451|><|audio_code_49600|><|audio_code_61949|><|audio_code_54218|><|audio_code_37312|><|audio_code_55390|><|audio_code_37080|><|audio_code_56465|><|audio_code_25537|><|audio_code_50625|><|audio_code_25538|><|audio_code_16833|><|audio_code_53624|><|audio_code_54621|><|audio_code_5003|><|audio_code_1795|><|audio_code_53713|><|audio_code_49098|><|audio_code_14080|><|audio_code_52708|><|audio_code_14843|><|audio_code_24515|><|audio_code_24028|><|audio_code_40955|><|audio_code_12387|><|audio_code_24248|><|audio_code_40856|><|audio_code_1283|><|audio_code_40643|><|audio_code_2498|><|audio_code_25920|><|audio_code_292|><|audio_code_24421|><|audio_code_62916|><|audio_code_27457|><|audio_code_4986|><|audio_code_56250|><|audio_code_53163|><|audio_code_9601|><|audio_code_49088|><|audio_code_56280|><|audio_code_38336|><|audio_code_1832|><|audio_code_28137|><|audio_code_42185|><|audio_code_36680|><|audio_code_38240|><|audio_code_60328|><|audio_code_56776|><|audio_code_1825|><|audio_code_38728|><|audio_code_14106|><|audio_code_53496|><|audio_code_10946|><|audio_code_39154|><|audio_code_11969|><|audio_code_2354|><|audio_code_61057|><|audio_code_38339|><|audio_code_24060|><|audio_code_386|><|audio_code_20930|><|audio_code_11608|><|audio_code_1874|><|audio_code_53600|><|audio_code_37824|><|audio_code_11168|><|audio_code_53690|><|audio_code_20928|><|audio_code_37128|><|audio_code_55272|><|audio_code_56168|><|audio_code_55171|><|audio_code_38786|><|audio_code_20755|><|audio_code_14282|><|audio_code_11578|><|audio_code_2939|><|audio_code_26080|><|audio_code_21498|><|audio_code_36321|><|audio_code_38328|><|audio_code_36810|><|audio_code_9049|><|audio_code_11755|><|audio_code_18392|><|audio_code_27040|><|audio_code_25448|><|audio_code_54144|><|audio_code_52712|><|audio_code_20456|><|audio_code_14314|><|audio_code_8482|><|audio_code_25443|><|audio_code_2378|><|audio_code_55010|><|audio_code_12609|><|audio_code_12721|><|audio_code_51549|><|audio_code_14274|><|audio_code_54088|><|audio_code_11754|><|audio_code_2500|><|audio_code_8634|><|audio_code_61930|><|audio_code_40940|><|audio_code_23530|><|audio_code_62957|><|audio_code_61749|><|audio_code_410|><|audio_code_30659|><|audio_code_51019|><|audio_code_58307|><|audio_code_51140|><|audio_code_25912|><|audio_code_2020|><|audio_code_40674|><|audio_code_12236|><|audio_code_51108|><|audio_code_60900|><|audio_code_29036|><|audio_code_50152|><|audio_code_39050|><|audio_code_34761|><|audio_code_24003|><|audio_code_53753|><|audio_code_33737|><|audio_code_38378|><|audio_code_12476|><|audio_code_6612|><|audio_code_11081|><|audio_code_10553|><|audio_code_38761|><|audio_code_59496|><|audio_code_803|><|audio_code_12554|><|audio_code_24555|><|audio_code_323|><|audio_code_40898|><|audio_code_63843|><|audio_code_38339|><|audio_code_58771|><|audio_code_56306|><|audio_code_458|><|audio_code_62409|><|audio_code_28098|><|audio_code_51138|><|audio_code_40293|><|audio_code_12794|><|audio_code_36347|><|audio_code_128|><|audio_code_1866|><|audio_code_63690|><|audio_code_58315|><|audio_code_27082|><|audio_code_26940|><|audio_code_10586|><|audio_code_15722|><|audio_code_10690|><|audio_code_63458|><|audio_code_5058|><|audio_code_248|><|audio_code_25506|><|audio_code_51163|><|audio_code_19400|><|audio_code_62923|><|audio_code_63445|><|audio_code_25795|><|audio_code_38340|><|audio_code_63562|><|audio_code_14291|><|audio_code_62346|><|audio_code_2416|><|audio_code_28649|><|audio_code_44833|><|audio_code_10221|><|audio_code_25410|><|audio_code_46068|><|audio_code_36603|><|audio_code_27003|><|audio_code_62593|><|audio_code_2434|><|audio_code_7446|><|audio_code_24425|><|audio_code_15803|><|audio_code_5760|><|audio_code_61891|><|audio_code_56650|><|audio_code_32706|><|audio_code_40906|><|audio_code_21826|><|audio_code_11234|><|audio_code_3008|><|audio_code_54220|><|audio_code_50132|><|audio_code_13797|><|audio_code_59874|><|audio_code_53568|><|audio_code_53144|><|audio_code_257|><|audio_code_54266|><|audio_code_256|><|audio_code_53696|><|audio_code_320|><|audio_code_51512|><|audio_code_50112|><|audio_code_25808|><|audio_code_10698|><|audio_code_6851|><|audio_code_53193|><|audio_code_12746|><|audio_code_52498|><|audio_code_2019|><|audio_code_43976|><|audio_code_14081|><|audio_code_58698|><|audio_code_26976|><|audio_code_23033|><|audio_code_33080|><|audio_code_38232|><|audio_code_36305|><|audio_code_52928|><|audio_code_53632|><|audio_code_53576|><|audio_code_1376|><|audio_code_14088|><|audio_code_27337|><|audio_code_27475|><|audio_code_24850|><|audio_code_2332|><|audio_code_20168|><|audio_code_5106|><|audio_code_54956|><|audio_code_12603|><|audio_code_44298|><|audio_code_10568|><|audio_code_13064|><|audio_code_51392|><|audio_code_14913|><|audio_code_27778|><|audio_code_2113|><|audio_code_55552|><|audio_code_2329|><|audio_code_51344|><|audio_code_51480|><|audio_code_61304|><|audio_code_29459|><|audio_code_36586|><|audio_code_12609|><|audio_code_27648|><|audio_code_63808|><|audio_code_58539|><|audio_code_12777|><|audio_code_43106|><|audio_code_38395|><|audio_code_39003|><|audio_code_38155|><|audio_code_32780|><|audio_code_10433|><|audio_code_2218|><|audio_code_25832|><|audio_code_1818|><|audio_code_24849|><|audio_code_12267|><|audio_code_14823|><|audio_code_2300|><|audio_code_13104|><|audio_code_25921|><|audio_code_450|><|audio_code_61688|><|audio_code_36803|><|audio_code_37345|><|audio_code_2547|><|audio_code_56800|><|audio_code_36585|><|audio_code_25167|><|audio_code_52328|><|audio_code_11986|><|audio_code_25536|><|audio_code_13304|><|audio_code_60883|><|audio_code_11201|><|audio_code_329|><|audio_code_7957|><|audio_code_11202|><|audio_code_51202|><|audio_code_26568|><|audio_code_24968|><|audio_code_13888|><|audio_code_61387|><|audio_code_56803|><|audio_code_19946|><|audio_code_39370|><|audio_code_48827|><|audio_code_12548|><|audio_code_27136|><|audio_code_249|><|audio_code_185|><|audio_code_7384|><|audio_code_27010|><|audio_code_9670|><|audio_code_37347|><|audio_code_51697|><|audio_code_63935|><|audio_code_43019|><|audio_code_33034|><|audio_code_3523|><|audio_code_63123|><|audio_code_10731|><|audio_code_11596|><|audio_code_12792|><|audio_code_53699|><|audio_code_1172|><|audio_code_11755|><|audio_code_516|><|audio_code_40616|><|audio_code_51264|><|audio_code_1896|><|audio_code_12770|><|audio_code_57801|><|audio_code_15306|><|audio_code_34795|><|audio_code_38596|><|audio_code_4635|><|audio_code_25546|><|audio_code_14786|><|audio_code_4834|><|audio_code_21865|><|audio_code_25042|><|audio_code_61889|><|audio_code_56772|><|audio_code_15178|><|audio_code_7626|><|audio_code_14884|><|audio_code_43136|><|audio_code_10452|><|audio_code_906|><|audio_code_11768|><|audio_code_12225|><|audio_code_15298|><|audio_code_23490|><|audio_code_63973|><|audio_code_13120|><|audio_code_40640|><|audio_code_9163|><|audio_code_57282|><|audio_code_52416|><|audio_code_7659|><|audio_code_42963|><|audio_code_51194|><|audio_code_27131|><|audio_code_26305|><|audio_code_4295|><|audio_code_12472|><|audio_code_12665|><|audio_code_51136|><|audio_code_48096|><|audio_code_63938|><|audio_code_2531|><|audio_code_40417|><|audio_code_2444|><|audio_code_1498|><|audio_code_25600|><|audio_code_63440|><|audio_code_24514|><|audio_code_27912|><|audio_code_1475|><|audio_code_36289|><|audio_code_38857|><|audio_code_9674|><|audio_code_52546|><|audio_code_2553|><|audio_code_25600|><|audio_code_6104|><|audio_code_184|><|audio_code_63936|><|audio_code_25570|><|audio_code_12763|><|audio_code_62954|><|audio_code_12738|><|audio_code_34685|><|audio_code_12316|><|audio_code_38393|><|audio_code_43490|><|audio_code_51683|><|audio_code_57834|><|audio_code_1507|><|audio_code_47609|><|audio_code_59363|><|audio_code_51651|><|audio_code_32208|><|audio_code_1034|><|audio_code_52024|><|audio_code_54937|><|audio_code_53200|><|audio_code_62434|><|audio_code_12778|><|audio_code_12258|><|audio_code_53731|><|audio_code_5958|><|audio_code_63826|><|audio_code_12739|><|audio_code_14786|><|audio_code_51149|><|audio_code_385|><|audio_code_11716|><|audio_code_5117|><|audio_code_63986|><|audio_code_9692|><|audio_code_38394|><|audio_code_22661|><|audio_code_26304|><|audio_code_12628|><|audio_code_8042|><|audio_code_25961|><|audio_code_2497|><|audio_code_28092|><|audio_code_63471|><|audio_code_12780|><|audio_code_1924|><|audio_code_59346|><|audio_code_12260|><|audio_code_10728|><|audio_code_61789|><|audio_code_63944|><|audio_code_8000|><|audio_code_12186|><|audio_code_63906|><|audio_code_10041|><|audio_code_36344|><|audio_code_23745|><|audio_code_9025|><|audio_code_63848|><|audio_code_61409|><|audio_code_47056|><|audio_code_4953|><|audio_code_53240|><|audio_code_54544|><|audio_code_25864|><|audio_code_2370|><|audio_code_59845|><|audio_code_27628|><|audio_code_17868|><|audio_code_12739|><|audio_code_51160|><|audio_code_489|><|audio_code_39400|><|audio_code_793|><|audio_code_41328|><|audio_code_2296|><|audio_code_15160|><|audio_code_58201|><|audio_code_23944|><|audio_code_10618|><|audio_code_53739|><|audio_code_51168|><|audio_code_2508|><|audio_code_27122|><|audio_code_28099|><|audio_code_51193|><|audio_code_4986|><|audio_code_929|><|audio_code_38185|><|audio_code_53752|><|audio_code_40417|><|audio_code_13802|><|audio_code_51137|><|audio_code_11088|><|audio_code_53731|><|audio_code_56128|><|audio_code_331|><|audio_code_25920|><|audio_code_1898|><|audio_code_52032|><|audio_code_51056|><|audio_code_23012|><|audio_code_37720|><|audio_code_6625|><|audio_code_11617|><|audio_code_63236|><|audio_code_11202|><|audio_code_51354|><|audio_code_53211|><|audio_code_10625|><|audio_code_868|><|audio_code_38393|><|audio_code_49440|><|audio_code_61890|><|audio_code_36349|><|audio_code_8132|><|audio_code_15785|><|audio_code_5036|><|audio_code_17386|><|audio_code_35780|><|audio_code_62971|><|audio_code_33154|><|audio_code_62891|><|audio_code_41548|><|audio_code_5571|><|audio_code_20477|><|audio_code_10616|><|audio_code_61889|><|audio_code_51008|><|audio_code_1003|><|audio_code_378|><|audio_code_50659|><|audio_code_26617|><|audio_code_27584|><|audio_code_52800|><|audio_code_50656|><|audio_code_50683|><|audio_code_63938|><|audio_code_56275|><|audio_code_8657|><|audio_code_51965|><|audio_code_53699|><|audio_code_9932|><|audio_code_24490|><|audio_code_13177|><|audio_code_36480|><|audio_code_56194|><|audio_code_59274|><|audio_code_61892|><|audio_code_38371|><|audio_code_18380|><|audio_code_40612|><|audio_code_9180|><|audio_code_54481|><|audio_code_18401|><|audio_code_38340|><|audio_code_56259|><|audio_code_482|><|audio_code_53706|><|audio_code_220|><|audio_code_11716|><|audio_code_347|><|audio_code_38208|><|audio_code_39715|><|audio_code_58507|><|audio_code_12170|><|audio_code_28098|><|audio_code_12732|><|audio_code_466|><|audio_code_39418|><|audio_code_842|><|audio_code_17400|><|audio_code_12795|><|audio_code_5560|><|audio_code_20928|><|audio_code_63458|><|audio_code_28128|><|audio_code_8137|><|audio_code_10068|><|audio_code_51580|><|audio_code_7043|><|audio_code_51842|><|audio_code_38349|><|audio_code_35693|><|audio_code_37865|><|audio_code_10689|><|audio_code_58081|><|audio_code_40398|><|audio_code_9602|><|audio_code_2524|><|audio_code_26940|><|audio_code_8067|><|audio_code_10368|><|audio_code_2369|><|audio_code_2500|><|audio_code_11771|><|audio_code_2501|><|audio_code_2508|><|audio_code_24540|><|audio_code_62459|><|audio_code_11612|><|audio_code_56316|><|audio_code_10747|><|audio_code_36032|><|audio_code_16258|><|audio_code_14690|><|audio_code_37316|><|audio_code_51180|><|audio_code_53733|><|audio_code_58188|><|audio_code_51098|><|audio_code_62602|><|audio_code_1978|><|audio_code_38364|><|audio_code_52033|><|audio_code_3009|><|audio_code_62417|><|audio_code_56108|><|audio_code_53740|><|audio_code_2508|><|audio_code_10560|><|audio_code_23884|><|audio_code_54969|><|audio_code_25570|><|audio_code_60297|><|audio_code_5628|><|audio_code_23523|><|audio_code_20953|><|audio_code_12060|><|audio_code_57812|><|audio_code_53725|><|audio_code_56809|><|audio_code_8698|><|audio_code_27628|><|audio_code_53745|><|audio_code_56265|><|audio_code_62763|><|audio_code_14268|><|audio_code_1962|><|audio_code_25337|><|audio_code_25547|><|audio_code_40668|><|audio_code_58818|><|audio_code_1346|><|audio_code_10562|><|audio_code_12693|><|audio_code_322|><|audio_code_51649|><|audio_code_38379|><|audio_code_15356|><|audio_code_27896|><|audio_code_40816|><|audio_code_12747|><|audio_code_55800|><|audio_code_4066|><|audio_code_53185|><|audio_code_55092|><|audio_code_14284|><|audio_code_40586|><|audio_code_12228|><|audio_code_1916|><|audio_code_12664|><|audio_code_53202|><|audio_code_61698|><|audio_code_27596|><|audio_code_8540|><|audio_code_33228|><|audio_code_30978|><|audio_code_27588|><|audio_code_27137|><|audio_code_36289|><|audio_code_33044|><|audio_code_38705|><|audio_code_63987|><|audio_code_769|><|audio_code_51148|><|audio_code_40898|><|audio_code_26051|><|audio_code_20420|><|audio_code_19292|><|audio_code_15811|><|audio_code_2370|><|audio_code_61898|><|audio_code_51652|><|audio_code_12772|><|audio_code_61387|><|audio_code_6985|><|audio_code_11755|><|audio_code_1481|><|audio_code_32732|><|audio_code_23530|><|audio_code_25995|><|audio_code_320|><|audio_code_61841|><|audio_code_1019|><|audio_code_385|><|audio_code_48576|><|audio_code_11225|><|audio_code_53658|><|audio_code_2016|><|audio_code_34762|><|audio_code_62952|><|audio_code_5561|><|audio_code_5954|><|audio_code_26562|><|audio_code_10657|><|audio_code_57850|><|audio_code_53738|><|audio_code_17866|><|audio_code_24544|><|audio_code_61412|><|audio_code_15297|><|audio_code_17354|><|audio_code_18395|><|audio_code_52162|><|audio_code_19323|><|audio_code_5969|><|audio_code_28124|><|audio_code_36818|><|audio_code_25579|><|audio_code_62427|><|audio_code_15537|><|audio_code_50643|><|audio_code_51138|><|audio_code_58818|><|audio_code_62938|><|audio_code_51648|><|audio_code_54968|><|audio_code_52168|><|audio_code_2540|><|audio_code_40898|><|audio_code_5100|><|audio_code_23034|><|audio_code_53443|><|audio_code_23300|><|audio_code_56075|><|audio_code_57282|><|audio_code_28097|><|audio_code_18624|><|audio_code_40954|><|audio_code_33176|><|audio_code_34781|><|audio_code_58345|><|audio_code_38370|><|audio_code_51411|><|audio_code_38356|><|audio_code_53467|><|audio_code_4490|><|audio_code_20444|><|audio_code_27840|><|audio_code_11219|><|audio_code_9410|><|audio_code_381|><|audio_code_51147|><|audio_code_10690|><|audio_code_2500|><|audio_code_56138|><|audio_code_38337|><|audio_code_4395|><|audio_code_51649|><|audio_code_26093|><|audio_code_12756|><|audio_code_48076|><|audio_code_50002|><|audio_code_57281|><|audio_code_51658|><|audio_code_36837|><|audio_code_38393|><|audio_code_52698|><|audio_code_32192|><|audio_code_37345|><|audio_code_63980|><|audio_code_11178|><|audio_code_13794|><|audio_code_61920|><|audio_code_53579|><|audio_code_11138|><|audio_code_14812|><|audio_code_15337|><|audio_code_481|><|audio_code_25564|><|audio_code_33217|><|audio_code_27609|><|audio_code_25536|><|audio_code_23529|><|audio_code_28089|><|audio_code_6488|><|audio_code_15316|><|audio_code_1960|><|audio_code_19419|><|audio_code_2362|><|audio_code_53632|><|audio_code_53220|><|audio_code_11090|><|audio_code_11212|><|audio_code_63938|><|audio_code_62434|><|audio_code_50137|><|audio_code_15353|><|audio_code_1475|><|audio_code_61899|><|audio_code_48588|><|audio_code_353|><|audio_code_14281|><|audio_code_13656|><|audio_code_17856|><|audio_code_58820|><|audio_code_62947|><|audio_code_12780|><|audio_code_38736|><|audio_code_962|><|audio_code_62401|><|audio_code_53698|><|audio_code_12740|><|audio_code_25858|><|audio_code_10649|><|audio_code_28026|><|audio_code_24490|><|audio_code_61900|><|audio_code_28154|><|audio_code_11746|><|audio_code_6024|><|audio_code_12763|><|audio_code_26058|><|audio_code_52181|><|audio_code_23522|><|audio_code_51521|><|audio_code_28627|><|audio_code_24556|><|audio_code_29125|><|audio_code_12795|><|audio_code_25538|><|audio_code_37884|><|audio_code_51539|><|audio_code_26562|><|audio_code_37825|><|audio_code_63978|><|audio_code_26108|><|audio_code_11755|><|audio_code_25537|><|audio_code_17802|><|audio_code_5570|><|audio_code_12740|><|audio_code_63938|><|audio_code_17864|><|audio_code_10698|><|audio_code_14320|><|audio_code_14275|><|audio_code_21980|><|audio_code_60393|><|audio_code_5099|><|audio_code_11009|><|audio_code_53187|><|audio_code_2477|><|audio_code_52676|><|audio_code_10626|><|audio_code_36098|><|audio_code_15307|><|audio_code_7044|><|audio_code_57283|><|audio_code_48096|><|audio_code_44946|><|audio_code_27072|><|audio_code_12264|><|audio_code_54722|><|audio_code_27080|><|audio_code_63938|><|audio_code_11752|><|audio_code_54217|><|audio_code_2412|><|audio_code_33089|><|audio_code_61916|><|audio_code_25403|><|audio_code_12745|><|audio_code_56257|><|audio_code_15306|><|audio_code_12236|><|audio_code_5115|><|audio_code_55754|><|audio_code_57296|><|audio_code_40900|><|audio_code_62944|><|audio_code_52169|><|audio_code_38348|><|audio_code_36290|><|audio_code_6554|><|audio_code_62401|><|audio_code_56769|><|audio_code_40396|><|audio_code_62868|><|audio_code_20476|><|audio_code_25820|><|audio_code_20418|><|audio_code_8580|><|audio_code_17899|><|audio_code_461|><|audio_code_24060|><|audio_code_24043|><|audio_code_28105|><|audio_code_1994|><|audio_code_51139|><|audio_code_63965|><|audio_code_23489|><|audio_code_23491|><|audio_code_53715|><|audio_code_15306|><|audio_code_36291|><|audio_code_23524|><|audio_code_26619|><|audio_code_5589|><|audio_code_14812|><|audio_code_46019|><|audio_code_16722|><|audio_code_14273|><|audio_code_12736|><|audio_code_14794|><|audio_code_39874|><|audio_code_60362|><|audio_code_505|><|audio_code_7673|><|audio_code_63992|><|audio_code_14280|><|audio_code_12267|><|audio_code_24552|><|audio_code_10723|><|audio_code_54250|><|audio_code_15177|><|audio_code_2514|><|audio_code_2297|><|audio_code_6093|><|audio_code_46075|><|audio_code_8133|><|audio_code_18243|><|audio_code_24034|><|audio_code_12740|><|audio_code_7132|><|audio_code_40908|><|audio_code_17370|><|audio_code_26985|><|audio_code_352|><|audio_code_6474|><|audio_code_62914|><|audio_code_6650|><|audio_code_15812|><|audio_code_28025|><|audio_code_61401|><|audio_code_2001|><|audio_code_12048|><|audio_code_63979|><|audio_code_38587|><|audio_code_56778|><|audio_code_36035|><|audio_code_12736|><|audio_code_10723|><|audio_code_12266|><|audio_code_61890|><|audio_code_360|><|audio_code_63876|><|audio_code_38346|><|audio_code_53740|><|audio_code_2539|><|audio_code_38753|><|audio_code_38345|><|audio_code_36098|><|audio_code_39420|><|audio_code_2442|><|audio_code_61429|><|audio_code_26435|><|audio_code_340|><|audio_code_1922|><|audio_code_717|><|audio_code_25539|><|audio_code_12740|><|audio_code_35596|><|audio_code_26091|><|audio_code_27309|><|audio_code_24051|><|audio_code_59839|><|audio_code_19908|><|audio_code_39403|><|audio_code_27620|><|audio_code_40898|><|audio_code_340|><|audio_code_23006|><|audio_code_4987|><|audio_code_25597|><|audio_code_23233|><|audio_code_2501|><|audio_code_49097|><|audio_code_63875|><|audio_code_31682|><|audio_code_27106|><|audio_code_388|><|audio_code_24001|><|audio_code_53660|><|audio_code_28106|><|audio_code_38661|><|audio_code_53179|><|audio_code_34115|><|audio_code_20422|><|audio_code_22955|><|audio_code_56267|><|audio_code_12226|><|audio_code_28043|><|audio_code_13246|><|audio_code_52395|><|audio_code_25575|><|audio_code_51389|><|audio_code_31643|><|audio_code_37947|><|audio_code_15107|><|audio_code_56773|><|audio_code_63940|><|audio_code_58821|><|audio_code_324|><|audio_code_58833|><|audio_code_25484|><|audio_code_4997|><|audio_code_61895|><|audio_code_27499|><|audio_code_12780|><|audio_code_62371|><|audio_code_18891|><|audio_code_36308|><|audio_code_25429|><|audio_code_36157|><|audio_code_28317|><|audio_code_12610|><|audio_code_589|><|audio_code_38817|><|audio_code_51197|><|audio_code_27523|><|audio_code_56803|><|audio_code_7427|><|audio_code_7625|><|audio_code_38372|><|audio_code_53700|><|audio_code_25026|><|audio_code_53708|><|audio_code_19332|><|audio_code_61419|><|audio_code_25581|><|audio_code_38379|><|audio_code_27076|><|audio_code_40828|><|audio_code_2479|><|audio_code_27115|><|audio_code_37839|><|audio_code_42436|><|audio_code_996|><|audio_code_34782|><|audio_code_10698|><|audio_code_39373|><|audio_code_12740|><|audio_code_14278|><|audio_code_58332|><|audio_code_7621|><|audio_code_2516|><|audio_code_461|><|audio_code_37327|><|audio_code_25542|><|audio_code_49607|><|audio_code_469|><|audio_code_37314|><|audio_code_51660|><|im_end|>
<|im_start|>assistant

Generating: 0%| | 0/1 [00:00<?, ?steps/s]INFO: 10.0.0.250:53502 - "POST /query_result HTTP/1.1" 200 OK
Generating: 0%| | 0/1 [00:03<?, ?steps/s, Prefill=582tok/s, Decode=61tok/s]INFO: 10.0.0.250:53518 - "POST /query_result HTTP/1.1" 200 OK
Generating: 100%|############################################################################################################################| 1/1 [00:05<00:00, 5.20s/steps, Prefill=582tok/s, Decode=83tok/s]
2026-02-09 10:44:01.245 | DEBUG | acestep.llm_inference:parse_lm_output:2465 - Debug output text:
bpm: 200
caption: An energetic and hypnotic tech-house track built around a heavily processed
and chopped female vocal sample. The vocal is pitched up and looped, creating a
frantic, catchy hook that drives the entire song. A punchy four-on-the-floor kick
drum and a groovy, rolling synth bassline establish an infectious dance rhythm.
The arrangement uses classic dance music dynamics, featuring filter sweeps, risers,
and brief breakdowns where the beat drops away to emphasize the manipulated vocal
chops before slamming back in with full force.
duration: 229
genres:empowering pop
keyscale: D minor
language: unknown
timesignature: 4

2026-02-09 10:44:01.246 | INFO | acestep.llm_inference:understand_audio_from_codes:1646 - Understanding completed. Generated 8 metadata fields

Summary by CodeRabbit

• Bug Fixes
  • Strengthened audio file path validation with enhanced security checks for temporary directory access
  • Improved request validation to prevent unsafe path handling
  • Refined audio file path processing for better system stability

[coderabbitai]

📝 Walkthrough

Walkthrough

Audio path validation logic is restructured in the API server: absolute paths are now permitted only under the system temporary directory; validation steps are moved earlier in the request pipeline for JSON requests, while the internal request builder now receives pre-processed paths directly.

Changes

Cohort / File(s)	Summary
Audio Path Validation acestep/api_server.py	Modified _validate_audio_path to allow absolute paths residing under system temp directory while rejecting unsafe absolute paths outside; adds early return for paths in allowed temp dir.
Request Handling Pipeline acestep/api_server.py	Shifted audio path validation from _build_request to upstream JSON request handling using intermediate RequestParser validation; _build_request now accepts pre-validated paths directly without per-call validation.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• ACE-Step-1.5#343 — Modifies audio-path validation and handling in the same file, making changes to where and how reference_audio_path/src_audio_path are validated in the request pipeline.

Suggested reviewers

• ChuxiJ

Poem

🐰 Paths once wandered through the code so free,
Now validated early, safe as can be,
Temp directories blessed, traversals denied,
With checks moved upstream, security's our guide! 🛡️

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly summarizes the main change: allowing server-generated temp paths in file uploads to fix 400 errors, which aligns with the primary objective of the PR.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

acestep/api_server.py (1)

2240-2312: ⚠️ Potential issue | 🟠 Major

Re-apply audio path validation for all JSON variants.

Validation now runs only for application/json, but +json and raw-JSON fallback branches accept unvalidated paths, reintroducing unsafe absolute paths. Please validate in those branches too (or centralize it).

✅ Suggested consolidation

         def _build_request(p: RequestParser, **kwargs) -> GenerateMusicRequest:
             """Build GenerateMusicRequest from parsed parameters."""
             # Pop audio path overrides from kwargs to avoid duplicate keyword arguments
             # when callers (multipart/form, url-encoded, raw body) pass them explicitly.
             ref_audio = kwargs.pop("reference_audio_path", None) or p.str("reference_audio_path") or None
             src_audio = kwargs.pop("src_audio_path", None) or p.str("src_audio_path") or None
             return GenerateMusicRequest(
                 ...
                 reference_audio_path=ref_audio,
                 src_audio_path=src_audio,
                 ...
             )
+
+        def _build_request_with_validated_paths(p: RequestParser) -> GenerateMusicRequest:
+            return _build_request(
+                p,
+                reference_audio_path=_validate_audio_path(p.str("reference_audio_path") or None),
+                src_audio_path=_validate_audio_path(p.str("src_audio_path") or None),
+            )

         if content_type.startswith("application/json"):
             body = await request.json()
             if not isinstance(body, dict):
                 raise HTTPException(status_code=400, detail="JSON payload must be an object")
             verify_token_from_request(body, authorization)
-
-            # VALIDATE STRINGS HERE
-            p = RequestParser(body)
-            req = _build_request(
-                p,
-                reference_audio_path=_validate_audio_path(p.str("reference_audio_path") or None),
-                src_audio_path=_validate_audio_path(p.str("src_audio_path") or None)
-            )
+            req = _build_request_with_validated_paths(RequestParser(body))
         elif content_type.endswith("+json"):
             body = await request.json()
             if not isinstance(body, dict):
                 raise HTTPException(status_code=400, detail="JSON payload must be an object")
             verify_token_from_request(body, authorization)
-            req = _build_request(RequestParser(body))
+            req = _build_request_with_validated_paths(RequestParser(body))
 ...
                 if isinstance(body, dict):
                     verify_token_from_request(body, authorization)
-                    req = _build_request(RequestParser(body))
+                    req = _build_request_with_validated_paths(RequestParser(body))

🤖 Fix all issues with AI agents

In `@acestep/api_server.py`:
- Around line 892-920: The allowlist check in _validate_audio_path is vulnerable
to prefix bypass (e.g., /tmp_evil when system_temp is /tmp); change the logic to
compute real/normalized paths for both system temp and requested path and use
os.path.commonpath to verify the requested path is inside the system temp
directory (or compare with a separator-boundary check), and when allowed return
the normalized/real requested path (not the original input); also ensure you
still catch FileNotFoundError and keep the subsequent absolute-path and
path-traversal (..) checks for relative paths.

[coderabbitai]

⚠️ Potential issue | 🔴 Critical

Harden temp-dir allowlist check to avoid prefix bypass.

startswith(system_temp) allows /tmp_evil/... when system_temp=/tmp, which defeats the intended restriction. Use os.path.commonpath (or ensure a separator boundary) and return the normalized path to avoid bypasses.

🔒 Proposed fix

 def _validate_audio_path(path: Optional[str]) -> Optional[str]:
     """Validate a user-supplied audio file path to prevent path traversal attacks."""
     if not path:
         return None
     
     # Get the system's real temporary directory path
     import tempfile
     system_temp = os.path.realpath(tempfile.gettempdir())
     
     try:
         requested_path = os.path.realpath(path)
         # ALLOW if the path is inside the system temp directory (server-generated files)
-        if requested_path.startswith(system_temp):
-            return path
-    except FileNotFoundError:
+        try:
+            if os.path.commonpath([requested_path, system_temp]) == system_temp:
+                return requested_path
+        except ValueError:
+            # Different drive on Windows → treat as outside temp
+            pass
+    except FileNotFoundError:
         # Path doesn't exist, so it can't be a trusted server-generated absolute path.
         # We'll proceed to check for other security issues like being an untrusted absolute path.
         pass

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	def _validate_audio_path(path: Optional[str]) -> Optional[str]:
	"""Validate a user-supplied audio file path to prevent path traversal attacks.
	Rejects absolute paths and paths containing '..' traversal sequences.
	Returns the validated path or None if the input is None/empty.
	Raises HTTPException 400 if the path is unsafe.
	"""
	"""Validate a user-supplied audio file path to prevent path traversal attacks."""
	if not path:
	return None
	# Reject absolute paths (Unix and Windows)
	# Get the system's real temporary directory path
	import tempfile
	system_temp = os.path.realpath(tempfile.gettempdir())
	try:
	requested_path = os.path.realpath(path)
	# ALLOW if the path is inside the system temp directory (server-generated files)
	if requested_path.startswith(system_temp):
	return path
	except FileNotFoundError:
	# Path doesn't exist, so it can't be a trusted server-generated absolute path.
	# We'll proceed to check for other security issues like being an untrusted absolute path.
	pass
	# REJECT if it's an absolute path anywhere else
	if os.path.isabs(path):
	raise HTTPException(status_code=400, detail="absolute audio file paths are not allowed")
	# Reject path traversal via '..' components
	raise HTTPException(status_code=400, detail="Absolute audio file paths are not allowed")
	# REJECT path traversal (..) for relative paths
	normalized = os.path.normpath(path)
	if ".." in normalized.split(os.sep):
	raise HTTPException(status_code=400, detail="path traversal in audio file paths is not allowed")
	raise HTTPException(status_code=400, detail="Path traversal in audio file paths is not allowed")
	return path
	def _validate_audio_path(path: Optional[str]) -> Optional[str]:
	"""Validate a user-supplied audio file path to prevent path traversal attacks."""
	if not path:
	return None
	# Get the system's real temporary directory path
	import tempfile
	system_temp = os.path.realpath(tempfile.gettempdir())
	try:
	requested_path = os.path.realpath(path)
	# ALLOW if the path is inside the system temp directory (server-generated files)
	try:
	if os.path.commonpath([requested_path, system_temp]) == system_temp:
	return requested_path
	except ValueError:
	# Different drive on Windows → treat as outside temp
	pass
	except FileNotFoundError:
	# Path doesn't exist, so it can't be a trusted server-generated absolute path.
	# We'll proceed to check for other security issues like being an untrusted absolute path.
	pass
	# REJECT if it's an absolute path anywhere else
	if os.path.isabs(path):
	raise HTTPException(status_code=400, detail="Absolute audio file paths are not allowed")
	# REJECT path traversal (..) for relative paths
	normalized = os.path.normpath(path)
	if ".." in normalized.split(os.sep):
	raise HTTPException(status_code=400, detail="Path traversal in audio file paths is not allowed")
	return path

🤖 Prompt for AI Agents

In `@acestep/api_server.py` around lines 892 - 920, The allowlist check in
_validate_audio_path is vulnerable to prefix bypass (e.g., /tmp_evil when
system_temp is /tmp); change the logic to compute real/normalized paths for both
system temp and requested path and use os.path.commonpath to verify the
requested path is inside the system temp directory (or compare with a
separator-boundary check), and when allowed return the normalized/real requested
path (not the original input); also ensure you still catch FileNotFoundError and
keep the subsequent absolute-path and path-traversal (..) checks for relative
paths.