Potential fix for code scanning alert no. 2: Uncontrolled data used in path expression

api/dashboard.js

@@ -2,11 +2,13 @@ import fs from 'fs';
 import path from 'path';
 import Database from 'better-sqlite3';
 import { fileURLToPath } from 'url';
+import sanitizeFilename from 'sanitize-filename';
 import { getConfig } from '../config/loader.js';
 import { updateConfig } from '../config/manager.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const PROJECT_ROOT = path.dirname(__dirname);
+const SAFE_FOLDER_NAME_RE = /^[A-Za-z0-9._ -]+$/;
 
 /**
  * Get database connection
@@ -320,34 +322,82 @@ export function triggerIndexing(folderPath) {
   try {
     const config = getConfig();
 
-    // Validate folder path exists
-    if (!fs.existsSync(folderPath)) {
-      throw new Error(`Folder does not exist: ${folderPath}`);
+    if (typeof folderPath !== 'string' || !folderPath.trim()) {
+      throw new Error('Invalid folder path');
     }
 
-    if (!fs.statSync(folderPath).isDirectory()) {
-      throw new Error(`Path is not a directory: ${folderPath}`);
+    // Build canonical allowlist roots first
+    const allowedRoots = Array.isArray(config.PROJECT_FOLDERS) ? config.PROJECT_FOLDERS : [];
+    const canonicalAllowedRoots = allowedRoots
+      .filter(root => typeof root === 'string' && root.trim())
+      .map(root => path.resolve(root))
+      .filter(root => fs.existsSync(root))
+      .map(root => fs.realpathSync(root))
+      .filter(root => fs.statSync(root).isDirectory());
+
+    if (canonicalAllowedRoots.length === 0) {
+      throw new Error('No valid configured project folders available');
+    }
+
+    // Accept only a simple safe folder name (no separators, traversal, or special chars)
+    const requestedFolderName = folderPath.trim();
+    const sanitizedFolderName = sanitizeFilename(requestedFolderName);
+    if (
+      !sanitizedFolderName ||
+      sanitizedFolderName !== requestedFolderName ||
+      sanitizedFolderName === '.' ||
+      sanitizedFolderName === '..' ||
+      sanitizedFolderName.includes('/') ||
+      sanitizedFolderName.includes('\\') ||
+      sanitizedFolderName.includes('\0') ||
+      !SAFE_FOLDER_NAME_RE.test(sanitizedFolderName)
+    ) {
+      throw new Error('Invalid folder path');
+    }
+
+    // Resolve from trusted roots only
+    let canonicalRequestedPath = null;
+    for (const root of canonicalAllowedRoots) {
+      const candidatePath = path.join(root, sanitizedFolderName);
+      if (!fs.existsSync(candidatePath)) {
+        continue;
+      }
+      const candidateCanonicalPath = fs.realpathSync(candidatePath);
+      const isWithinRoot =
+        candidateCanonicalPath === root || candidateCanonicalPath.startsWith(root + path.sep);
+      if (!isWithinRoot) {
+        continue;
+      }
+      if (!fs.statSync(candidateCanonicalPath).isDirectory()) {
+        continue;
+      }
+      canonicalRequestedPath = candidateCanonicalPath;
+      break;
+    }
+
+    if (!canonicalRequestedPath) {
+      throw new Error(`Folder does not exist in configured project folders: ${folderPath}`);
     }
 
     // Import the Indexer class
     const { Indexer } = require('../indexer/indexer.js');
 
     // Create and run indexer for the folder
-    const indexer = new Indexer(folderPath);
+    const indexer = new Indexer(canonicalRequestedPath);
 
     // Run indexing (asynchronous)
     indexer.index()
       .then(() => {
-        console.log(`✓ Indexing completed for ${folderPath}`);
+        console.log(`✓ Indexing completed for ${canonicalRequestedPath}`);
       })
       .catch(err => {
-        console.error(`✗ Indexing failed for ${folderPath}: ${err.message}`);
+        console.error(`✗ Indexing failed for ${canonicalRequestedPath}: ${err.message}`);
       });
 
     return {
       success: true,
-      message: `Indexing started for ${folderPath}`,
-      folder: folderPath,
+      message: `Indexing started for ${canonicalRequestedPath}`,
+      folder: canonicalRequestedPath,
       startedAt: new Date().toISOString(),
     };
   } catch (error) {

mcp/server.js

@@ -477,9 +477,9 @@ function createExpressServer(port = 3000) {
 
   app.post('/api/index', (req, res) => {
     try {
-      const { folderPath } = req.body;
-      if (!folderPath) {
-        return res.status(400).json({ error: 'folderPath is required' });
+      const { folderPath } = req.body ?? {};
+      if (typeof folderPath !== 'string' || !folderPath.trim()) {
+        return res.status(400).json({ error: 'folderPath must be a non-empty string' });
       }
       const result = triggerIndexing(folderPath);
       res.json(result);

package.json

@@ -35,7 +35,8 @@
     "chokidar": "^3.5.3",
     "express": "^4.18.2",
     "fast-glob": "^3.3.2",
-    "express-rate-limit": "^8.3.2"
+    "express-rate-limit": "^8.3.2",
+    "sanitize-filename": "^1.6.4"
   },
   "devDependencies": {}
 }