fix: validate request paths securely

[vultuk]

This pull request strengthens path handling and security checks throughout the file and git API endpoints in server/api.ts. The main improvements are the consistent use of path.resolve to obtain absolute paths and the adoption of a more robust method for validating that file and directory operations remain within the working directory. This helps prevent directory traversal attacks and ensures safer file system access.

Security and Path Validation Improvements:

• Replaced path.join with path.resolve for all file and directory path constructions, ensuring absolute paths are used and reducing ambiguity. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13]
• Updated security checks to use path.relative for verifying that target paths are within the working directory, replacing the previous startsWith approach. This method is more reliable and helps prevent bypasses due to path normalization issues. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12]

Consistency Across API Endpoints:

• Applied the above changes to all file operations (get, post, delete for files and directories) and git operations (add, commit, push, clone), ensuring consistent and secure behavior throughout the API. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13]

These changes collectively improve the security and reliability of file system and git operations exposed by the API.

[Copilot]

Pull Request Overview

This pull request enhances security for file system operations by implementing more robust path validation to prevent directory traversal attacks. The changes replace path.join with path.resolve for absolute path construction and switch from a startsWith check to a more reliable path.relative based validation method.

• Replaced path.join with path.resolve for all file and directory path operations
• Updated security validation to use path.relative instead of startsWith checks
• Applied consistent security improvements across all file and git API endpoints

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}