fix(security): enforce user base path on all request paths

JoinBasePath returned the request path unchanged whenever it started
with "/". Since FixAndCleanPath always prepends "/", that branch
matched every request, so the user's base path was never applied and
only the exact path "/" was rebased (by User.JoinPath).

A user restricted to a base path could therefore address any path in
the tree: with the built-in guest/general role scope of "/", a guest
confined to /public could list and download other storages by
requesting their absolute paths. It also broke normal navigation for
such users, since entering a subfolder resolved to the real root
instead of a path under the base.

Restore the join. Regression introduced in 6b2d81e (#9249).

Covered by tests asserting that non-root request paths are rebased and
that relative segments are still rejected.

Author: okatu-loli

pkg/utils/path.go

@@ -89,12 +89,6 @@ func JoinBasePath(basePath, reqPath string) (string, error) {
 		return "", errs.RelativePath
 	}
 
-	reqPath = FixAndCleanPath(reqPath)
-
-	if strings.HasPrefix(reqPath, "/") {
-		return reqPath, nil
-	}
-
 	return stdpath.Join(FixAndCleanPath(basePath), FixAndCleanPath(reqPath)), nil
 }
 

pkg/utils/path_test.go

@@ -66,3 +66,36 @@ func TestJoinUnderBase(t *testing.T) {
 		t.Fatalf("expected nested path to be rejected")
 	}
 }
+
+func TestJoinBasePath(t *testing.T) {
+	// A user's base path confines every request path, not just "/".
+	datas := []struct {
+		basePath string
+		reqPath  string
+		want     string
+	}{
+		{"/public", "/", "/public"},
+		{"/public", "/sub", "/public/sub"},
+		{"/public", "sub", "/public/sub"},
+		{"/public", "/sub/file.txt", "/public/sub/file.txt"},
+		{"/public", "/other_storage", "/public/other_storage"},
+		{"/", "/sub", "/sub"},
+		{"", "/sub", "/sub"},
+	}
+	for _, d := range datas {
+		got, err := JoinBasePath(d.basePath, d.reqPath)
+		if err != nil {
+			t.Fatalf("JoinBasePath(%q, %q) error: %v", d.basePath, d.reqPath, err)
+		}
+		if got != d.want {
+			t.Errorf("JoinBasePath(%q, %q) = %q, want %q", d.basePath, d.reqPath, got, d.want)
+		}
+	}
+
+	// relative segments must still be rejected
+	for _, reqPath := range []string{"..", "../x", "/x/..", "/x/../y"} {
+		if _, err := JoinBasePath("/public", reqPath); err == nil {
+			t.Errorf("JoinBasePath(%q, %q) expected error, got nil", "/public", reqPath)
+		}
+	}
+}