Function validateSQLitePath

packages/components/src/validator.ts:320–359

(userProvidedPath: string | undefined)

 * @throws {Error} If the path is missing, contains traversal patterns, or is outside allowed directories
 */
export const validateSQLitePath = (userProvidedPath: string | undefined): string => {
    const allowedDirs = getAllowedSQLiteBaseDirs()
    const defaultDir = allowedDirs[0]

    if (process.env.PATH_TRAVERSAL_SAFETY === 'false') {
        if (!userProvidedPath || userProvidedPath.trim() === '') {
            return path.join(defaultDir, 'database.sqlite')
        }
        const bypassPath = userProvidedPath.trim()
        return path.isAbsolute(bypassPath) ? bypassPath : path.resolve(path.join(defaultDir, bypassPath))
    }

    if (!userProvidedPath || userProvidedPath.trim() === '') {
        throw new Error('Invalid SQLite path: database path is required')
    }

    const basePath = userProvidedPath.trim()

    if (basePath.includes('..')) throw new Error('Invalid SQLite path: path traversal attempt detected')
    if (basePath.toLowerCase().includes('%2e') || basePath.toLowerCase().includes('%2f') || basePath.toLowerCase().includes('%5c'))
        throw new Error('Invalid SQLite path: encoded path traversal attempt detected')
    // eslint-disable-next-line no-control-regex
    if (/\0/.test(basePath) || /[\x00-\x1f]/.test(basePath))
        throw new Error('Invalid SQLite path: null bytes or control characters detected')
    if (/^[a-zA-Z]:\\/.test(basePath)) throw new Error('Invalid SQLite path: Windows absolute paths are not allowed')
    if (/^\\\\[^\\]/.test(basePath)) throw new Error('Invalid SQLite path: UNC paths are not allowed')
    if (/^\\\\\?\\/.test(basePath)) throw new Error('Invalid SQLite path: extended-length paths are not allowed')

    const resolvedPath = path.isAbsolute(basePath) ? path.resolve(basePath) : path.resolve(path.join(defaultDir, basePath))

    if (resolvedPath.includes('..')) throw new Error('Invalid SQLite path: path traversal detected in resolved path')

    if (!isPathWithinAllowedSQLiteDirs(resolvedPath, allowedDirs)) {
        throw new Error(
            `Invalid SQLite path: path must be within allowed directories (${allowedDirs.join(', ')}). Attempted path: ${resolvedPath}`
        )
    }

    return resolvedPath
}

/**
 * Sanitize a file name to prevent path traversal attacks.