build: harden controller v2 runtime

controller/config.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import math
 import os
 from dataclasses import dataclass, field
 from pathlib import Path
@@ -135,6 +136,8 @@ def _number(value: Any, name: str, *, minimum: float = 0.0) -> float:
         result = float(value)
     except (TypeError, ValueError, OverflowError) as exc:
         raise ConfigError(f"{name} must be a number") from exc
+    if not math.isfinite(result):
+        raise ConfigError(f"{name} must be finite")
     if result < minimum:
         raise ConfigError(f"{name} must be >= {minimum}")
     return result
@@ -240,6 +243,10 @@ def load_config(
         raise ConfigError("storage.database_name must be a filename")
     if Path(storage.legacy_yaml_name).name != storage.legacy_yaml_name:
         raise ConfigError("storage.legacy_yaml_name must be a filename")
+    if not storage.media_base.is_absolute():
+        raise ConfigError("storage.media_base must be an absolute path")
+    if not storage.data_base.is_absolute():
+        raise ConfigError("storage.data_base must be an absolute path")
 
     cookie_raw = _env_value(env, "YTPLAYER_COOKIE_PATH", downloads_raw.get("cookie_path", "/run/secrets/yt-dlp-cookies.txt"))
     downloads = DownloadConfig(
@@ -252,6 +259,8 @@ def load_config(
     )
     if downloads.cookie_required and downloads.cookie_path is None:
         raise ConfigError("downloads.cookie_path is required when cookie_required is true")
+    if downloads.cookie_path is not None and not downloads.cookie_path.is_absolute():
+        raise ConfigError("downloads.cookie_path must be an absolute path")
 
     unknown_behavior = _text(router_raw.get("when_state_unknown", "attempt"), "router.when_state_unknown")
     if unknown_behavior not in {"attempt", "continue", "reject"}: