From 9f232b5225f92d974a979c066849a54f7be9e84d Mon Sep 17 00:00:00 2001
From: MrFastwind <MrFastwind@users.noreply.github.com>
Date: Thu, 23 Jul 2026 20:15:06 +0200
Subject: [PATCH] fix(backend): add path validation to DeleteMod and improve
 GetLog security

- DeleteMod now validates path prefix against SERVERFILE_DIR and MODS_DIR
  before allowing deletion (prevents arbitrary directory deletion)
- GetLog uses strings.ContainsAny for cross-platform path traversal check
---
 backend/internal/api/logs.go |  2 +-
 backend/internal/api/mods.go | 15 ++++++++++++++-
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/backend/internal/api/logs.go b/backend/internal/api/logs.go
index 675a182..7d05272 100644
--- a/backend/internal/api/logs.go
+++ b/backend/internal/api/logs.go
@@ -170,7 +170,7 @@ func findLatestRPT(dir string) string {
 
 func (h *Handler) GetLog(c *gin.Context) {
 	filename := filepath.Base(c.Param("file"))
-	if filename == "" || strings.ContainsRune(c.Param("file"), os.PathSeparator) {
+	if filename == "" || filename == "." || strings.ContainsAny(filename, "/\\") {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid filename"})
 		return
 	}
diff --git a/backend/internal/api/mods.go b/backend/internal/api/mods.go
index be17a17..e63cef4 100644
--- a/backend/internal/api/mods.go
+++ b/backend/internal/api/mods.go
@@ -2,6 +2,8 @@ package api
 
 import (
 	"net/http"
+	"path/filepath"
+	"strings"
 
 	"arma3-web-server/internal/services"
 
@@ -54,7 +56,18 @@ func (h *Handler) DeleteMod(c *gin.Context) {
 		return
 	}
 
-	if err := services.RemoveMod(input.Path); err != nil {
+	absPath, err := filepath.Abs(input.Path)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid path"})
+		return
+	}
+
+	if !strings.HasPrefix(absPath, h.serverfileDir) && !strings.HasPrefix(absPath, h.modsDir) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "path outside allowed directories"})
+		return
+	}
+
+	if err := services.RemoveMod(absPath); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}