Function validateAndResolveFilePath

pkg/waveappstore/waveappstore.go:235–261

(appDir string, fileName string)

}

func validateAndResolveFilePath(appDir string, fileName string) (string, error) {
	if filepath.IsAbs(fileName) {
		return "", fmt.Errorf("fileName must be relative, got absolute path: %s", fileName)
	}

	cleanPath := filepath.Clean(fileName)
	if strings.HasPrefix(cleanPath, "..") || strings.Contains(cleanPath, string(filepath.Separator)+"..") {
		return "", fmt.Errorf("path traversal not allowed: %s", fileName)
	}

	fullPath := filepath.Join(appDir, cleanPath)
	resolvedPath, err := filepath.Abs(fullPath)
	if err != nil {
		return "", fmt.Errorf("failed to resolve path: %w", err)
	}

	resolvedAppDir, err := filepath.Abs(appDir)
	if err != nil {
		return "", fmt.Errorf("failed to resolve app directory: %w", err)
	}

	if !strings.HasPrefix(resolvedPath, resolvedAppDir+string(filepath.Separator)) && resolvedPath != resolvedAppDir {
		return "", fmt.Errorf("path escapes app directory: %s", fileName)
	}

	return resolvedPath, nil
}

func WriteAppFile(appId string, fileName string, contents []byte) error {
	if err := ValidateAppId(appId); err != nil {