test better deployment mappings

server/utils/validation.js

@@ -2,6 +2,8 @@
  * Input validation and sanitization utilities for server-side security
  */
 
+import path from 'path';
+
 /**
  * Validates Docker image name against Docker naming conventions
  * @param {string} image - Docker image name
@@ -324,6 +326,63 @@ function isValidNumericRange(value, min, max) {
   return true;
 }
 
+/**
+ * Validates directory path for file browser
+ * @param {string} path - Directory path
+ * @returns {boolean} - True if valid
+ */
+function isValidDirectoryPath(path) {
+  if (!path || typeof path !== 'string') return false;
+  
+  // Prevent path traversal
+  if (path.includes('..')) return false;
+  
+  // Must be absolute path
+  if (!path.startsWith('/')) return false;
+  
+  // Basic length check
+  if (path.length > 4096) return false;
+  
+  return true;
+}
+
+/**
+ * Sanitizes directory path for safe filesystem access
+ * @param {string} path - Directory path
+ * @returns {string} - Sanitized path
+ */
+function sanitizeDirectoryPath(path) {
+  if (!path || typeof path !== 'string') return '/';
+  
+  // Remove null bytes and control characters
+  let sanitized = path.replace(/[\x00-\x1F\x7F]/g, '').trim();
+  
+  // Resolve to absolute path and prevent traversal
+  try {
+    // Resolve the path to handle relative components safely
+    sanitized = path.resolve(sanitized);
+    
+    // Ensure it's still absolute after resolution
+    if (!path.isAbsolute(sanitized)) {
+      sanitized = '/';
+    }
+    
+    // Additional safety: prevent access to sensitive directories
+    // This is a basic check - you may want to add more restrictions
+    const sensitivePaths = ['/etc', '/sys', '/proc', '/dev'];
+    for (const sensitive of sensitivePaths) {
+      if (sanitized.startsWith(sensitive) && sanitized !== sensitive) {
+        // Allow root level but not deeper
+        return '/';
+      }
+    }
+  } catch (error) {
+    return '/';
+  }
+  
+  return sanitized;
+}
+
 export {
   isValidImageName,
   isValidContainerName,
@@ -342,7 +401,9 @@ export {
   isValidIpAddress,
   isValidSelectOption,
   isValidPresetValue,
-  isValidNumericRange
+  isValidNumericRange,
+  isValidDirectoryPath,
+  sanitizeDirectoryPath
 };