Function assertWithinUserDir

server/api/import/index.post.ts:309–319

(userTempDir: string, targetPath: string)

}

function assertWithinUserDir(userTempDir: string, targetPath: string): void {
  const base = path.resolve(userTempDir);
  const resolved = path.resolve(targetPath);
  if (resolved !== base && !resolved.startsWith(base + path.sep)) {
    throw handleApiError(
      400,
      `Path traversal detected: ${resolved} escapes ${base}`,
      "Invalid upload path.",
    );
  }
}

async function handleChunkUpload(formData: any[], userId: string) {
  const fileId = formData.find((p) => p.name === "fileId")?.data.toString();