mirror of
https://github.com/hanzoai/dataroom.git
synced 2026-10-30 18:41:07 +00:00
Marc Seitz
826d28e732
Introduced a Zod schema for validating folder path parameters to prevent type confusion and path traversal attacks. Updated all relevant API routes to use this schema for input validation, improving security and consistency across folder-related endpoints.
31 lines
773 B
TypeScript
31 lines
773 B
TypeScript
import { z } from "zod";
|
|
|
|
/**
|
|
* Schema to validate folder path parameters in catch-all routes.
|
|
* Protects against both type confusion and path traversal attacks.
|
|
*/
|
|
export const folderPathSchema = z
|
|
.array(
|
|
z
|
|
.string()
|
|
.min(1, "Folder name cannot be empty")
|
|
.refine(
|
|
(name) => !name.includes(".."),
|
|
"Path traversal attempts are not allowed",
|
|
)
|
|
.refine(
|
|
(name) => !name.includes("/"),
|
|
"Folder names cannot contain forward slashes",
|
|
)
|
|
.refine(
|
|
(name) => !name.includes("\\"),
|
|
"Folder names cannot contain backslashes",
|
|
),
|
|
)
|
|
.min(1, "Folder path cannot be empty");
|
|
|
|
/**
|
|
* Type for validated folder path
|
|
*/
|
|
export type FolderPath = z.infer<typeof folderPathSchema>;
|