fix: reject path traversal in chart and file parameters

[HahaSula]

Summary

• POST /folders/init: rejects chart values containing .. or absolute paths (closes POST /folders/init missing path traversal validation on chart parameter #33)
• GET /api/git/diff: applies the same guard to the file parameter (closes GET /api/git/diff missing path traversal validation on file parameter #34)
• Integration tests added for both endpoints covering .. and absolute path cases

Test plan

• POST /folders/init with chart: '../../etc' → 400
• POST /folders/init with chart: '/etc/passwd' → 400
• GET /api/git/diff?file=../../etc/passwd → 400
• GET /api/git/diff?file=/etc/passwd → 400

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Tightened input validation for folder initialization and diff requests to reject invalid or unsafe file/chart paths.
  • Requests with missing, absolute, or path-traversal values now return clearer 400 errors instead of being partially accepted.
• Tests
  • Added integration coverage for invalid path and path-traversal cases in both folder and git endpoints.

[rophy]

PR Preview Bot

Preview environment torn down.

[coderabbitai]

Warning

Review limit reached

@HahaSula, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 45 minutes and 7 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 0e856bb2-ab04-4849-8d57-442498fd9cbf

📥 Commits

Reviewing files that changed from the base of the PR and between 66909bc and 80b4491.

📒 Files selected for processing (2)

• server/routes/folders.js
• server/routes/git.js

📝 Walkthrough

Walkthrough

Both /api/v2/folders/init and /api/v2/git/diff now reject missing, traversal, and absolute-path inputs with HTTP 400 responses. Integration tests were added for the new validation cases on both endpoints.

Changes

Route path validation

Layer / File(s)	Summary
Route validation updates server/routes/folders.js, server/routes/git.js	/init and /diff now reject missing, .., and absolute-path values for chart and file, returning updated 400 error messages.
Integration coverage tests/integration/folders-api.test.js, tests/integration/git-api.test.js	Added endpoint tests that assert 400 responses for traversal and absolute-path inputs on both routes.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested reviewers

• rophy

Poem

A bunny hopped through paths of code,
and fenced the trails where bad bytes strode.
No .. may sneak, no root-path leap,
the diff and charts are safe to keep.
🐇✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: rejecting path traversal in chart and file parameters.
Linked Issues check	✅ Passed	The PR satisfies #33 and #34 by adding the requested validation and integration tests for both endpoints.
Out of Scope Changes check	✅ Passed	The changes stay within scope, limited to input validation hardening and tests for the two affected routes.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/path-traversal-chart-and-file

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@server/routes/folders.js`:
- Around line 114-115: The input validation in the `init` handler should reject
non-string `folder` and `chart` values before calling string/path methods, since
`includes(...)` and `path.isAbsolute(...)` can throw on objects, numbers, or
arrays and cause a 500. Update the existing guard around the `folder` and
`chart` checks in `server/routes/folders.js` to first verify both fields are
strings, then apply the path traversal and absolute-path checks, returning the
same 400 response for any invalid type or value.

In `@server/routes/git.js`:
- Around line 156-158: The `/diff` path validation in `git.js` should guard the
`file` query value’s type before using `path.isAbsolute`, since `req.query.file`
may be an array or object and currently can throw instead of returning the
intended 400. Update the existing validation block around the `file` check to
only run string-based path checks when `file` is a string, and treat any
non-string `file` as invalid alongside the existing `..` and absolute-path
checks.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6b8abef9-6922-4838-b09a-6b1356d0a372

📥 Commits

Reviewing files that changed from the base of the PR and between ea87c50 and 66909bc.

📒 Files selected for processing (4)

• server/routes/folders.js
• server/routes/git.js
• tests/integration/folders-api.test.js
• tests/integration/git-api.test.js