From 30db5839a93936f8b69d0d5d005bbe03197722c1 Mon Sep 17 00:00:00 2001
From: Jeff Halter <868228+jhalter@users.noreply.github.com>
Date: Mon, 1 Jun 2026 10:56:43 -0700
Subject: Normalize folder upload item paths and consolidate path handling

Anchor the path returned by folderUpload.FormattedPath relative to the
upload root so item paths are resolved consistently, matching the
behavior of ReadPath. Resolve each destination path once per item in
UploadFolderHandler and use path.Join in place of manual string
concatenation.

Add test coverage for FormattedPath normalization.
---
 hotline/file_transfer_test.go | 62 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 62 insertions(+)

(limited to 'hotline/file_transfer_test.go')

diff --git a/hotline/file_transfer_test.go b/hotline/file_transfer_test.go
index a5c4afe..d427352 100644
--- a/hotline/file_transfer_test.go
+++ b/hotline/file_transfer_test.go
@@ -255,6 +255,68 @@ func Test_folderUpload_FormattedPath(t *testing.T) {
 			},
 			want: "test@$%&",
 		},
+		{
+			// Traversal attempt: leading ".." segments must be collapsed and cannot escape the upload root.
+			name:          "traversal with parent dir segments",
+			pathItemCount: [2]byte{0x00, 0x04},
+			fileNamePath: []byte{
+				0x00, 0x00, // path separator
+				0x02,       // segment length
+				0x2e, 0x2e, // ".."
+				0x00, 0x00, // path separator
+				0x02,       // segment length
+				0x2e, 0x2e, // ".."
+				0x00, 0x00, // path separator
+				0x03,             // segment length
+				0x65, 0x74, 0x63, // "etc"
+				0x00, 0x00, // path separator
+				0x06,                               // segment length
+				0x70, 0x61, 0x73, 0x73, 0x77, 0x64, // "passwd"
+			},
+			want: "etc/passwd",
+		},
+		{
+			// Interior ".." segments resolve away without escaping.
+			name:          "traversal with interior parent dir segments",
+			pathItemCount: [2]byte{0x00, 0x04},
+			fileNamePath: []byte{
+				0x00, 0x00, // path separator
+				0x03,             // segment length
+				0x66, 0x6f, 0x6f, // "foo"
+				0x00, 0x00, // path separator
+				0x02,       // segment length
+				0x2e, 0x2e, // ".."
+				0x00, 0x00, // path separator
+				0x02,       // segment length
+				0x2e, 0x2e, // ".."
+				0x00, 0x00, // path separator
+				0x03,             // segment length
+				0x62, 0x61, 0x72, // "bar"
+			},
+			want: "bar",
+		},
+		{
+			// A lone ".." segment collapses to the upload root (empty relative path).
+			name:          "single parent dir segment",
+			pathItemCount: [2]byte{0x00, 0x01},
+			fileNamePath: []byte{
+				0x00, 0x00, // path separator
+				0x02,       // segment length
+				0x2e, 0x2e, // ".."
+			},
+			want: "",
+		},
+		{
+			// A single segment whose raw bytes embed separators and "..".
+			name:          "segment containing embedded separators",
+			pathItemCount: [2]byte{0x00, 0x01},
+			fileNamePath: []byte{
+				0x00, 0x00, // path separator
+				0x09,                                                 // segment length
+				0x2e, 0x2e, 0x2f, 0x2e, 0x2e, 0x2f, 0x65, 0x74, 0x63, // "../../etc" (9 bytes)
+			},
+			want: "etc",
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-- 
cgit