security: remediate vulnerabilities and issues from codebase audit

backend/handlers/utils.go

@@ -5,6 +5,7 @@ import (
 	"os"
 	"path/filepath"
 	"regexp"
+	"strings"
 )
 
 var numberSuffixRegex = regexp.MustCompile(` \(\d+\)$`)
@@ -31,3 +32,26 @@ func GetUniquePath(baseDir, name string) string {
 		}
 	}
 }
+
+// resolveSafe safely resolves a requested path against a root directory,
+// ensuring the result is completely contained within the root.
+// Returns the absolute clean path or an error if traversal is detected.
+func resolveSafe(rootDir, reqPath string) (string, error) {
+	cleanRoot := filepath.Clean(rootDir)
+	
+	// Pre-check for typical traversal patterns to be safe
+	cleanReq := filepath.Clean(filepath.FromSlash(reqPath))
+	if strings.HasPrefix(cleanReq, "..") || strings.HasPrefix(cleanReq, "/") || strings.HasPrefix(cleanReq, "\\") {
+		return "", fmt.Errorf("invalid path: contains traversal patterns")
+	}
+
+	absPath := filepath.Join(cleanRoot, cleanReq)
+
+	// Ensure the resulting path starts with the root directory + separator
+	// (or is exactly the root directory)
+	if !strings.HasPrefix(absPath, cleanRoot+string(filepath.Separator)) && absPath != cleanRoot {
+		return "", fmt.Errorf("path traversal attempt detected")
+	}
+
+	return absPath, nil
+}