Addresses the NASA VDP-2966 finding reported in cloud-management-project#256.

Problem

The unauthenticated POST /validate endpoint passed a client-controlled filename directly into os.path.join(TMP_DIR, filename). Since os.path.join discards the base path when the second argument is absolute — and there were no traversal/separator checks — a caller could steer uploaded content to arbitrary locations in the Lambda's writable area.

Scope note: the Lambda root filesystem is read-only, so this is not a full arbitrary-write-to-code. But /tmp is writable and persists across warm invocations, and the function uses CACHE_DIR=/tmp for pyQuARC's cache. An attacker controlling the full path within /tmp could poison that shared cache (corrupting validation results served to other users) or fill the 512 MB /tmp to DoS the function. CWE-22, CWE-73.

Changes

• safe_upload_path() — the client filename is never trusted for path construction. Only a sanitized basename is kept (for display), written into a fresh per-request /tmp/uploads/<uuid>/ directory, with a post-resolution containment check. Neutralizes absolute paths, ../ traversal, nested paths, and cross-request filename collisions in warm containers. Also fixes a latent crash when filename is omitted (path.join(TMP_DIR, None) → TypeError).
• try/finally around request handling — wrap_inputs() now runs inside the try, and the per-request AUTH_TOKEN env var is cleared and uploads are removed in finally. Previously an exception in wrap_inputs() (e.g. the missing-filename crash) skipped the AUTH_TOKEN pop, leaking one user's Earthdata token into the next request in a warm container.
• Stop echoing secrets — the response no longer reflects auth_key or raw file content back in params.
• Basename in results — return only the uploaded file's basename, never the server path (updated from the old [5:] /tmp/ slice).
• API throttling — rate 20 / burst 40 on the public stage as defense in depth.

Testing

Verified safe_upload_path() contains every payload from the report (/tmp/evil.txt, ../../etc/passwd, a/b/c.xml, /etc/cron.d/pwn) plus None/empty within /tmp/uploads/<uuid>/; handler.py compiles clean.