fix: resolve CodeQL security issues for URL redirects and CORS

[MarkProminic]

fix: resolve CodeQL security issues for URL redirects and CORS

Summary

This PR addresses 4 CodeQL security findings by implementing URL validation for redirects and fixing permissive CORS configuration:

1. Added URL validation utility: New isLocalUrl() function in config/paths.js that validates URLs stay on the same origin
2. Fixed 3 untrusted URL redirections in routes/fileServer.js:
   • Directory trailing slash redirect (line 231)
   • Legacy create-folder endpoint redirect (line 1082)
   • Legacy search endpoint redirect (line 1086)
3. Fixed permissive CORS configuration in app.js: When allow_origin: true is set with an empty whitelist, now defaults to blocking all CORS requests instead of allowing all origins

All redirects now validate the target URL before redirecting, and CORS configuration properly enforces whitelisting.

Review & Testing Checklist for Human

🔴 High Priority (3 items)

• Test legitimate directory access: Navigate to a directory URL without trailing slash (e.g., /some/folder) and verify it still redirects to /some/folder/ correctly
• Test CORS functionality: Verify that applications with properly configured CORS whitelists can still make cross-origin requests successfully
• Verify domain validation logic: The isLocalUrl() function uses https://localhost as the base - confirm this approach works correctly with your actual domain setup in production

Notes

• The URL validation follows CodeQL's recommended approach of parsing URLs relative to a base origin
• Security warnings are now logged when potentially unsafe redirects are rejected
• Empty CORS whitelists with allow_origin: true now fail secure (block all) rather than allow all origins
• Legacy query parameter endpoints (?action=create-folder, ?action=search) continue to work but with validation

Link to Devin run: https://app.devin.ai/sessions/7854353c8b2c43edb12a9967e5c7cdb5
Requested by: @MarkProminic (mark.gilbert@prominic.net)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring