Function validateGroupId

packages/utils/src/lib/wal-sharded.ts:28–57

* Validates that a groupId is safe to use as a single path segment. * Rejects path traversal attempts and path separators to prevent writing outside intended directory. * * @param groupId - The groupId to validate * @throws Error if groupId contains unsafe characters or path traversal sequences

(groupId: string)

 * @throws Error if groupId contains unsafe characters or path traversal sequences
 */
function validateGroupId(groupId: string): void {
  // Reject empty or whitespace-only groupIds
  if (!groupId || groupId.trim().length === 0) {
    throw new Error('groupId cannot be empty or whitespace-only');
  }

  // Reject path separators (both forward and backward slashes)
  if (groupId.includes('/') || groupId.includes('\\')) {
    throw new Error('groupId cannot contain path separators');
  }

  // Reject relative path components
  if (groupId === '..' || groupId === '.') {
    throw new Error('groupId cannot be "." or ".."');
  }

  // Reject null bytes which can be used to bypass validation
  if (groupId.includes('\0')) {
    throw new Error('groupId cannot contain null bytes');
  }

  // Validate that the resolved path stays within the intended directory
  // This catches cases where the path library normalizes to a parent directory
  const normalized = path.normalize(groupId);
  if (normalized !== groupId || normalized.startsWith('..')) {
    throw new Error(
      `groupId normalization resulted in unsafe path: ${normalized}`,
    );
  }
}

// eslint-disable-next-line functional/no-let
let shardCount = 0;