Prevent path traversal for local storage

Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>

Author: nuclearcat

src/local.rs

@@ -66,7 +66,20 @@ fn ensure_directory_exists(file_path: &Path) -> Result<(), std::io::Error> {
 fn get_storage_file_path(filename: &str) -> PathBuf {
     let config = get_local_config();
     let storage_path = Path::new(&config.storage_path);
-    storage_path.join(filename)
+    // Strip leading slashes to ensure the path is always relative to storage root
+    let safe_name = filename.trim_start_matches('/');
+    let full = storage_path.join(safe_name);
+    // Defense-in-depth: verify resolved path stays within storage root
+    let canonical_storage = storage_path.canonicalize().unwrap_or_else(|_| storage_path.to_path_buf());
+    // Use the parent directory for canonicalization since the file may not exist yet
+    let parent = full.parent().unwrap_or(&full);
+    let canonical_parent = parent.canonicalize().unwrap_or_else(|_| parent.to_path_buf());
+    if !canonical_parent.starts_with(&canonical_storage) {
+        // Fall back to storage root to prevent escape
+        storage_path.join(Path::new(safe_name).file_name().unwrap_or_default())
+    } else {
+        full
+    }
 }
 
 /// Get metadata file path for storing headers

src/main.rs

@@ -693,6 +693,8 @@ async fn ax_post_file(
                     } else {
                         format!("{}/{}", path, file0_filename)
                     };
+                    // Normalize: strip leading slashes so the path is always relative
+                    let full_path = full_path.trim_start_matches('/').to_string();
 
                     // validate path for traversal
                     match validate_path(&full_path) {
@@ -828,6 +830,8 @@ async fn ax_post_file(
             } else {
                 format!("{}/{}", path, file0_filename)
             };
+            // Normalize: strip leading slashes so the path is always relative
+            let full_path = full_path.trim_start_matches('/').to_string();
 
             match validate_path(&full_path) {
                 Ok(_) => (),