From 72d0d6a3a931a46d6333aec7309624c9fceb7edd Mon Sep 17 00:00:00 2001
From: "3371392206@qq.com" <3371392206@qq.com>
Date: Tue, 25 Aug 2026 23:09:47 +0800
Subject: [PATCH] =?UTF-8?q?VUL-001=20(=E4=B8=AD):=20aac/flac=20=E5=93=8D?=
 =?UTF-8?q?=E5=BA=94=20Content-Type=20=E4=B8=8E=E7=9C=9F=E5=AE=9E=E6=95=B0?=
 =?UTF-8?q?=E6=8D=AE=E4=B8=8D=E4=B8=80=E8=87=B4=20=20=20controller.tts.go:?=
 =?UTF-8?q?contentTypeFor=20=E5=AF=B9=20aac/flac=20=E8=BF=94=E5=9B=9E=20au?=
 =?UTF-8?q?dio/aac/flac,=20=20=20=E4=BD=86=20adapter/volcano/synthesis.go?=
 =?UTF-8?q?=20=E5=9C=A8=E4=B8=8A=E6=B8=B8=E9=99=8D=E7=BA=A7=E6=97=B6?=
 =?UTF-8?q?=E4=BB=85=E4=BF=AE=E6=94=B9=20opts.Format,=20=20=20finalFormat?=
 =?UTF-8?q?=20=E4=BB=8D=E4=BF=9D=E7=95=99=20clientFormat,=E5=AF=BC?=
 =?UTF-8?q?=E8=87=B4=E5=93=8D=E5=BA=94=E5=A4=B4=E4=B8=8E=E5=AD=97=E8=8A=82?=
 =?UTF-8?q?=E6=B5=81=E4=B8=8D=E7=AC=A6=E3=80=82=20=20=20=E4=BF=AE=E5=A4=8D?=
 =?UTF-8?q?:finalFormat=20=E6=94=B9=E4=B8=BA=E5=8F=8D=E6=98=A0=E7=9C=9F?=
 =?UTF-8?q?=E5=AE=9E=E8=BE=93=E5=87=BA=E6=A0=BC=E5=BC=8F(=E9=9D=9E=20wav?=
 =?UTF-8?q?=20=E6=97=B6=E5=8F=96=20opts.Format),=20=20=20=E5=AE=A2?=
 =?UTF-8?q?=E6=88=B7=E7=AB=AF=E6=8C=89=20AAC/FLAC=20=E8=A7=A3=E7=A0=81=20M?=
 =?UTF-8?q?P3=20=E6=B5=81=E7=9A=84=E5=A4=B1=E8=B4=A5=E5=9C=BA=E6=99=AF?=
 =?UTF-8?q?=E6=B6=88=E9=99=A4=E3=80=82?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

VUL-004 (高): .env 凭据泄露
  README 引导用户 cp .env.example .env 填密钥,但 .gitignore
  未忽略 .env,任何 git add . 都会把含 BYTEDANCE_TTS_API_KEY
  的文件提交进 git 历史,不可逆。
  修复:
  - .gitignore 新增 Secrets section,拦截 .env 与 .env.* 变体,
    保留 .env.example 作为模板追踪
  - .dockerignore 升级为同名规则模式,覆盖未来 .env.local /
    .env.production 等变体,保证 git 与 docker 两通道一致

详见 VULNERABILITY_REPORT.md
"
---
 .dockerignore                | 3 ++-
 .gitignore                   | 9 +++++++--
 adapter/volcano/synthesis.go | 7 +++++++
 3 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/.dockerignore b/.dockerignore
index 45b0f8d..9a5c2ee 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,7 +1,8 @@
 *.exe
 *.md
 .env
-.env.example
+.env.*
+!.env.example
 .git
 .gitignore
 tts_api_architecture.html
diff --git a/.gitignore b/.gitignore
index e7ef1d8..8735742 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,4 @@
-# Go build cache
+# Go build cache
 .gocache/
 *.exe
 *.test
@@ -11,4 +11,9 @@
 Thumbs.db
 
 # Logs
-*.log
\ No newline at end of file
+*.log
+
+# Secrets (do NOT commit local .env files; keep .env.example tracked as template)
+.env
+.env.*
+!.env.example
\ No newline at end of file
diff --git a/adapter/volcano/synthesis.go b/adapter/volcano/synthesis.go
index 07ccbaa..5a461da 100644
--- a/adapter/volcano/synthesis.go
+++ b/adapter/volcano/synthesis.go
@@ -116,7 +116,14 @@ func Synthesis(
 	duration := time.Since(started)
 
 	finalData := parsed.AudioData
+	// finalFormat 反映真实输出格式(用于 controller 写 Content-Type):
+	//   - wav 走 pcm 上游 + 本地拼头,对外仍是 wav
+	//   - aac/flac 在上方已被上游降级为 mp3,真实输出也是 mp3
+	//   - 其余与 clientFormat 一致
 	finalFormat := clientFormat
+	if clientFormat != "wav" {
+		finalFormat = opts.Format
+	}
 	sampleRate := opts.SampleRate
 	if clientFormat == "wav" {
 		wav, wrapErr := WrapWAVHeader(parsed.AudioData, opts.SampleRate)