From 3430d1607233c5b012699dbb1a86c74a09795230 Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Wed, 7 Oct 2026 01:16:34 +0000
Subject: [PATCH] fix: add path validation in main.js

The /api/download/* endpoint extracts file paths from URL parameters using decodeURIComponent and string replacement without proper path canonicalization
Addresses CWE-22
---
 main.js | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/main.js b/main.js
index 691ba737..b36d8d61 100644
--- a/main.js
+++ b/main.js
@@ -920,22 +920,27 @@ ${bridgeCode}
       }
       
       // Validate path (UNC paths on Windows, absolute paths in Docker)
-      // Normalize temp dir path for comparison
-      const normalizedTempDir = os.tmpdir().replace(/\\/g, '/');
+      // Normalize path for comparison; use resolved (canonicalized) paths so
+      // '../' traversal sequences cannot spoof the temp/server-managed checks.
       const normalizedFilePath = actualFilePath.replace(/\\/g, '/');
       let isServerManagedPath = false;
+      let isTempFile = false;
       try {
         const resolvedFilePath = path.resolve(actualFilePath);
         const resolvedUserData = path.resolve(app.getPath('userData'));
         const resolvedDbDir = path.resolve(path.dirname(getDatabasePath()));
+        const resolvedTempDir = path.resolve(os.tmpdir());
         isServerManagedPath =
           resolvedFilePath === resolvedDbDir ||
           resolvedFilePath.startsWith(resolvedUserData + path.sep) ||
           resolvedFilePath.startsWith(resolvedDbDir + path.sep);
+        isTempFile =
+          resolvedFilePath === resolvedTempDir ||
+          resolvedFilePath.startsWith(resolvedTempDir + path.sep);
       } catch (error) {
         isServerManagedPath = false;
+        isTempFile = false;
       }
-      const isTempFile = normalizedFilePath.includes(normalizedTempDir);
       
       if (isDockerContainer()) {
         // In Docker, require absolute paths starting with /