Function ensureUserPathIsValidAndSecurelyAccessible

lib/models/files.ts:602–616

(userId: string, path: string)

 * @param path - The relative path (user-provided) to check
 */
export async function ensureUserPathIsValidAndSecurelyAccessible(userId: string, path: string): Promise<void> {
  const userRootPath = join(await AppConfig.getFilesRootPath(), userId, '/');

  const fullPath = join(userRootPath, path);

  const resolvedFullPath = `${resolve(fullPath)}/`;

  // Normalize path separators for consistent comparison on Windows
  const normalizedUserRootPath = userRootPath.replaceAll('\\', '/');
  const normalizedResolvedFullPath = resolvedFullPath.replaceAll('\\', '/');

  if (!normalizedResolvedFullPath.startsWith(normalizedUserRootPath)) {
    throw new Error('Invalid file path');
  }
}

/**
 * Ensures the file share path is valid and securely accessible (meaning it's not trying to access files outside of the file share's root directory).