fix: HandleVolumeAdd validates host and container paths (closes #107)

2026-02-20 03:33:19 -08:00 · 2026-02-20 03:33:19 -08:00 · efd3500dac
commit efd3500dac
parent ec87915234
1 changed files with 8 additions and 0 deletions
--- a/internal/handlers/app.go
+++ b/internal/handlers/app.go
@ -1022,6 +1022,14 @@ func (h *Handlers) HandleVolumeAdd() http.HandlerFunc {
 			return
 		}

+		pathErr := validateVolumePaths(hostPath, containerPath)
+		if pathErr != nil {
+			h.log.Error("invalid volume path", "error", pathErr)
+			http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
+
+			return
+		}
+
 		volume := models.NewVolume(h.db)
 		volume.AppID = application.ID
 		volume.HostPath = hostPath