fix: economy recovery double-refund/erased-liability/cap-drops, entity editor path traversal

1 files changed, 6 insertions, 0 deletions

diff --git a/internal/admin/yaml_util.go b/internal/admin/yaml_util.go
index 7157f15..9ef8058 100644
--- a/internal/admin/yaml_util.go
+++ b/internal/admin/yaml_util.go
@@ -182,6 +182,9 @@ func findEntityPath(dataDir, subdir, id string) (string, error) {
 }
 
 func moveEntityFile(dataDir, subdir, id, targetDir string) (string, string, []byte, error) {
+	if targetDir != "" && !validEntityID(targetDir) {
+		return "", "", nil, fmt.Errorf("invalid directory: %q", targetDir)
+	}
 	oldPath, err := findEntityPath(dataDir, subdir, id)
 	if err != nil {
 		return "", "", nil, fmt.Errorf("entity not found: %s/%s", subdir, id)
@@ -228,6 +231,9 @@ func createEntityDir(dataDir, subdir, name string) error {
 }
 
 func renameEntityFile(dataDir, subdir, oldID, newID string) (string, string, []byte, error) {
+	if !validEntityID(newID) {
+		return "", "", nil, fmt.Errorf("invalid new id: %q", newID)
+	}
 	oldPath, err := findEntityPath(dataDir, subdir, oldID)
 	if err != nil {
 		return "", "", nil, fmt.Errorf("entity not found: %s/%s", subdir, oldID)