fix: block path traversal in disk and http file proxies

lib/utils/resolve-file-proxy.ts

@@ -1,6 +1,6 @@
-import type { FileProxy } from "../db/schema"
 import { readFile } from "node:fs/promises"
-import { join } from "node:path"
+import { join, resolve, sep } from "node:path"
+import type { FileProxy } from "../db/schema"
 import { normalizePath } from "./normalize-path"
 
 export async function resolveFileProxy(
@@ -15,18 +15,37 @@ export async function resolveFileProxy(
   const prefix = pattern.slice(0, -1) // Remove "*" to get "prefix/"
   const relativePath = normalizedPath.slice(prefix.length)
 
+  // Block path traversal: reject paths containing '..' segments
+  const segments = relativePath.split("/")
+  if (segments.includes("..")) {
+    return new Response("Invalid path: path traversal not allowed", {
+      status: 400,
+    })
+  }
+
   if (proxy.proxy_type === "disk") {
     return resolveDiskProxy(proxy.disk_path, relativePath)
-  } else {
-    return resolveHttpProxy(proxy.http_target_url, relativePath)
   }
+  return resolveHttpProxy(proxy.http_target_url, relativePath)
 }
 
 async function resolveDiskProxy(
   diskPath: string,
   relativePath: string,
 ): Promise<Response> {
-  const fullPath = join(diskPath, relativePath)
+  const resolvedDiskPath = resolve(diskPath)
+  const fullPath = resolve(diskPath, relativePath)
+
+  // Defense in depth: verify that fullPath is contained within resolvedDiskPath root
+  const rootWithSep = resolvedDiskPath.endsWith(sep)
+    ? resolvedDiskPath
+    : resolvedDiskPath + sep
+
+  if (fullPath !== resolvedDiskPath && !fullPath.startsWith(rootWithSep)) {
+    return new Response("Invalid path: access outside root denied", {
+      status: 403,
+    })
+  }
 
   try {
     const content = await readFile(fullPath)

tests/routes/path-traversal-proxy.test.ts

@@ -0,0 +1,86 @@
+import { expect, test } from "bun:test"
+import { mkdtemp, rm, writeFile } from "node:fs/promises"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+import type { FileProxy } from "lib/db/schema"
+import { resolveFileProxy } from "lib/utils/resolve-file-proxy"
+import { getTestServer } from "tests/fixtures/get-test-server"
+
+test("resolveFileProxy rejects path traversal with '..' segments", async () => {
+  const diskProxy: FileProxy = {
+    file_proxy_id: "proxy-1",
+    proxy_type: "disk",
+    disk_path: "/srv/files-root",
+    matching_pattern: "local/*",
+    created_at: new Date().toISOString(),
+  }
+
+  const httpProxy: FileProxy = {
+    file_proxy_id: "proxy-2",
+    proxy_type: "http",
+    http_target_url: "https://example.com/files",
+    matching_pattern: "remote/*",
+    created_at: new Date().toISOString(),
+  }
+
+  // Traversal on disk proxy
+  const resDisk1 = await resolveFileProxy(diskProxy, "local/../secret.txt")
+  expect(resDisk1.status).toBe(400)
+  expect(await resDisk1.text()).toBe("Invalid path: path traversal not allowed")
+
+  const resDisk2 = await resolveFileProxy(diskProxy, "local/../../etc/passwd")
+  expect(resDisk2.status).toBe(400)
+
+  const resDisk3 = await resolveFileProxy(
+    diskProxy,
+    "local/nested/../../secret.txt",
+  )
+  expect(resDisk3.status).toBe(400)
+
+  // Traversal on http proxy
+  const resHttp = await resolveFileProxy(httpProxy, "remote/../admin")
+  expect(resHttp.status).toBe(400)
+  expect(await resHttp.text()).toBe("Invalid path: path traversal not allowed")
+})
+
+test("route-level traversal in /files/download is rejected", async () => {
+  const { axios } = await getTestServer()
+  const tempDir = await mkdtemp(join(tmpdir(), "traversal-test-"))
+
+  try {
+    await writeFile(join(tempDir, "allowed.txt"), "Safe file inside proxy")
+
+    const createRes = await axios.post("/file_proxies/create", {
+      proxy_type: "disk",
+      disk_path: tempDir,
+      matching_pattern: "safe-disk/*",
+    })
+    expect(createRes.status).toBe(200)
+
+    // Valid query access works
+    const validRes = await axios.get("/files/download", {
+      params: { file_path: "safe-disk/allowed.txt" },
+    })
+    expect(validRes.status).toBe(200)
+    expect(validRes.data).toBe("Safe file inside proxy")
+
+    // Traversal via query param is blocked with 400
+    await expect(
+      axios.get("/files/download", {
+        params: { file_path: "safe-disk/../secret.txt" },
+      }),
+    ).rejects.toMatchObject({
+      status: 400,
+    })
+
+    await expect(
+      axios.get("/files/download", {
+        params: { file_path: "safe-disk/../../etc/passwd" },
+      }),
+    ).rejects.toMatchObject({
+      status: 400,
+    })
+  } finally {
+    await rm(tempDir, { recursive: true, force: true })
+  }
+})