From 55037a52d18d8fcc75aa770c0978aa48e88c3d12 Mon Sep 17 00:00:00 2001
From: Mark Gilbert <50398495+MarkProminic@users.noreply.github.com>
Date: Tue, 30 Sep 2025 21:15:10 -0500
Subject: [PATCH] Potential fix for code scanning alert no. 24: Server-side URL
 redirect

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 routes/fileServer.js | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/routes/fileServer.js b/routes/fileServer.js
index 16e0bd2..70ee03a 100644
--- a/routes/fileServer.js
+++ b/routes/fileServer.js
@@ -1093,7 +1093,19 @@ router.post('*splat', (req, res, next) => {
   } else if (req.query.action === 'create-folder') {
     const newPath = `${req.path}/folders`;
 
-    if (!isLocalUrl(newPath)) {
+    // Only allow strictly relative paths, no path traversal, not protocol-relative, not external host
+    function isSafeRelativePath(path) {
+      // must start with a single "/"
+      if (typeof path !== 'string' || !path.startsWith('/')) return false;
+      // must not contain "//"
+      if (path.includes('//')) return false;
+      // must not contain ".."
+      if (path.includes('..')) return false;
+      // optional: restrict to allowed base directory/prefix
+      return true;
+    }
+
+    if (!isSafeRelativePath(newPath)) {
       logger.warn('Rejected potentially unsafe redirect', { path: newPath });
       return res.status(400).send('Invalid redirect path');
     }