From ad60843fbf577eda80105e3916822d663aaefcb3 Mon Sep 17 00:00:00 2001
From: historia <[not public]>
Date: Wed, 16 Sep 2026 02:14:02 -0400
Subject: fix: economy recovery double-refund/erased-liability/cap-drops,
 entity editor path traversal

---
 internal/admin/api_helpers.go | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

(limited to 'internal/admin/api_helpers.go')

diff --git a/internal/admin/api_helpers.go b/internal/admin/api_helpers.go
index 3224598..11ad958 100644
--- a/internal/admin/api_helpers.go
+++ b/internal/admin/api_helpers.go
@@ -4,10 +4,25 @@ import (
 	"bytes"
 	"fmt"
 	"os"
+	"strings"
 
 	"gopkg.in/yaml.v3"
 )
 
+// validEntityID reports whether an entity ID can be safely joined into a
+// file path under its data directory. IDs come from URL path segments and
+// JSON bodies, so an unchecked join could otherwise escape the data
+// directory ("../") or touch dot files.
+func validEntityID(id string) bool {
+	if id == "" || id == "." || id == ".." {
+		return false
+	}
+	if strings.ContainsAny(id, `/\`) || strings.ContainsRune(id, 0) {
+		return false
+	}
+	return true
+}
+
 func yamlToMap(data []byte) (map[string]any, error) {
 	var v any
 	if err := yaml.Unmarshal(data, &v); err != nil {
-- 
cgit v1.2.3