Potential fix for code scanning alert no. 1: Uncontrolled data used in path expression

[ilesinge]

Potential fix for https://github.com/ilesinge/shabda/security/code-scanning/1

The best way to fix this problem is to sanitize the user-provided definition string before using it in path construction. In this scenario, the definition is only used for naming a temporary file; therefore, the safest method is to pass it through werkzeug.utils.secure_filename before concatenating it into the file path. This eliminates dangerous characters and prevents directory traversal.

You should import secure_filename from werkzeug.utils at the top of the file, and then, just before constructing tmpfile, apply it:
definition_secure = secure_filename(definition)
Use definition_secure when forming tmpfile.

Files/regions/lines to change:

• In shabda/web.py, add from werkzeug.utils import secure_filename.
• In the speech_zip function, convert definition using secure_filename before using it to build tmpfile.
• Use the secured variable everywhere a path component is needed for this filename.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.