From 1c7bc95cdd7f7a3fbe1801c57ca96c84f1a15e2a Mon Sep 17 00:00:00 2001
From: Alessandro Ros <aler9.dev@gmail.com>
Date: Mon, 3 Aug 2026 18:47:25 +0200
Subject: [PATCH] prevent some CodeQL warnings (#6027)

---
 internal/api/api_recordings.go         | 35 ++++++++++++++++++++++++++
 internal/servers/hls/muxer_instance.go |  2 +-
 2 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/internal/api/api_recordings.go b/internal/api/api_recordings.go
index 5b91a425..fdfeae3e 100644
--- a/internal/api/api_recordings.go
+++ b/internal/api/api_recordings.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"net/http"
 	"os"
+	"path/filepath"
 	"strings"
 	"time"
 
@@ -13,6 +14,26 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
+// this prevents directory traversal.
+// functionally it's useless since there's already conf.IsValidPathName, but it's needed by CodeQL.
+func isSubdirectoryOf(base string, path string) error {
+	baseAbs, err := filepath.Abs(filepath.Clean(base))
+	if err != nil {
+		return err
+	}
+
+	candidateAbs, err := filepath.Abs(filepath.Join(baseAbs, path))
+	if err != nil {
+		return err
+	}
+
+	if !strings.HasPrefix(candidateAbs, baseAbs) {
+		return fmt.Errorf("path escapes base directory")
+	}
+
+	return nil
+}
+
 func recordingsOfPath(
 	pathConf *conf.Path,
 	pathName string,
@@ -100,15 +121,29 @@ func (a *API) onRecordingDeleteSegment(ctx *gin.Context) {
 		return
 	}
 
+	commonPath := recordstore.CommonPath(pathConf.RecordPath)
+
 	pathFormat := recordstore.PathAddExtension(
 		strings.ReplaceAll(pathConf.RecordPath, "%path", pathName),
 		pathConf.RecordFormat,
 	)
 
+	err = isSubdirectoryOf(commonPath, pathFormat)
+	if err != nil {
+		a.writeError(ctx, http.StatusBadRequest, err)
+		return
+	}
+
 	segmentPath := recordstore.Path{
 		Start: start,
 	}.Encode(pathFormat)
 
+	err = isSubdirectoryOf(pathFormat, segmentPath)
+	if err != nil {
+		a.writeError(ctx, http.StatusBadRequest, err)
+		return
+	}
+
 	err = os.Remove(segmentPath)
 	if err != nil {
 		a.writeError(ctx, http.StatusBadRequest, err)
diff --git a/internal/servers/hls/muxer_instance.go b/internal/servers/hls/muxer_instance.go
index ca516b81..299a7b62 100644
--- a/internal/servers/hls/muxer_instance.go
+++ b/internal/servers/hls/muxer_instance.go
@@ -27,7 +27,7 @@ const (
 )
 
 // this prevents directory traversal.
-// functionally it's useless since there's already conf.IsPathName, but it's needed by CodeQL.
+// functionally it's useless since there's already conf.IsValidPathName, but it's needed by CodeQL.
 func safeSubDirectory(base string, pathName string) (string, error) {
 	baseAbs, err := filepath.Abs(filepath.Clean(base))
 	if err != nil {