security: remediate vulnerabilities and issues from codebase audit

backend/handlers/tus.go

@@ -84,7 +84,11 @@ func (h *TusHandler) Create(c *fiber.Ctx) error {
 	}
 
 	// Resolve destination directory and ensure unique filename
-	destFull := filepath.Join(h.Config.StorageDir, filepath.FromSlash(destPath))
+	destFull, err := resolveSafe(h.Config.StorageDir, destPath)
+	if err != nil {
+		return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "invalid destination path"})
+	}
+	
 	uniqueFileName := GetUniquePath(destFull, fileName)
 
 	// Generate unique upload ID
@@ -184,17 +188,28 @@ func (h *TusHandler) Patch(c *fiber.Ctx) error {
 		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "seek failed"})
 	}
 
-	body := c.Body()
-	n, err := f.Write(body)
-	if err != nil {
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "write failed"})
+	reader := c.Context().RequestBodyStream()
+	if reader == nil {
+		// Fallback for smaller payloads or if streaming isn't fully active
+		body := c.Body()
+		n, err := f.Write(body)
+		if err != nil {
+			return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "write failed"})
+		}
+		
+		h.mu.Lock()
+		upload.Offset += int64(n)
+		h.mu.Unlock()
+	} else {
+		written, err := io.Copy(f, reader)
+		if err != nil {
+			return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "stream read/write failed"})
+		}
+		h.mu.Lock()
+		upload.Offset += written
+		h.mu.Unlock()
 	}
 
-	// Update offset
-	h.mu.Lock()
-	upload.Offset += int64(n)
-	h.mu.Unlock()
-
 	c.Set("Tus-Resumable", "1.0.0")
 	c.Set("Upload-Offset", strconv.FormatInt(upload.Offset, 10))