prevent some CodeQL warnings (#6027)

internal/api/api_recordings.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"net/http"
 	"os"
+	"path/filepath"
 	"strings"
 	"time"
 
@@ -13,6 +14,26 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
+// this prevents directory traversal.
+// functionally it's useless since there's already conf.IsValidPathName, but it's needed by CodeQL.
+func isSubdirectoryOf(base string, path string) error {
+	baseAbs, err := filepath.Abs(filepath.Clean(base))
+	if err != nil {
+		return err
+	}
+
+	candidateAbs, err := filepath.Abs(filepath.Join(baseAbs, path))
+	if err != nil {
+		return err
+	}
+
+	if !strings.HasPrefix(candidateAbs, baseAbs) {
+		return fmt.Errorf("path escapes base directory")
+	}
+
+	return nil
+}
+
 func recordingsOfPath(
 	pathConf *conf.Path,
 	pathName string,
@@ -100,15 +121,29 @@ func (a *API) onRecordingDeleteSegment(ctx *gin.Context) {
 		return
 	}
 
+	commonPath := recordstore.CommonPath(pathConf.RecordPath)
+
 	pathFormat := recordstore.PathAddExtension(
 		strings.ReplaceAll(pathConf.RecordPath, "%path", pathName),
 		pathConf.RecordFormat,
 	)
 
+	err = isSubdirectoryOf(commonPath, pathFormat)
+	if err != nil {
+		a.writeError(ctx, http.StatusBadRequest, err)
+		return
+	}
+
 	segmentPath := recordstore.Path{
 		Start: start,
 	}.Encode(pathFormat)
 
+	err = isSubdirectoryOf(pathFormat, segmentPath)
+	if err != nil {
+		a.writeError(ctx, http.StatusBadRequest, err)
+		return
+	}
+
 	err = os.Remove(segmentPath)
 	if err != nil {
 		a.writeError(ctx, http.StatusBadRequest, err)

internal/servers/hls/muxer_instance.go

@@ -27,7 +27,7 @@ const (
 )
 
 // this prevents directory traversal.
-// functionally it's useless since there's already conf.IsPathName, but it's needed by CodeQL.
+// functionally it's useless since there's already conf.IsValidPathName, but it's needed by CodeQL.
 func safeSubDirectory(base string, pathName string) (string, error) {
 	baseAbs, err := filepath.Abs(filepath.Clean(base))
 	if err != nil {