Solve CodeQL issues: re-apply sanitizations closer so it could trace them

Author: nemunaire

internal/app/handlers.go

@@ -222,9 +222,7 @@ type metapayload struct {
 }
 
 func userID(c *gin.Context) string {
-	//TODO: suppress the warning
-	//codeql[go/path-injection]
-	return c.GetString(userIDKey)
+	return common.SanitizeUid(c.GetString(userIDKey))
 }
 
 func extFromContentType(contentType string) (string, error) {

internal/storage/fs/blobstore.go

@@ -45,7 +45,9 @@ func (fs *FileSystemStorage) GetBlobURL(uid, blobid string, write bool) (docurl
 
 // LoadBlob Opens a blob by id
 func (fs *FileSystemStorage) LoadBlob(uid, blobid string) (reader io.ReadCloser, size int64, hash string, err error) {
-	blobPath := path.Join(fs.getUserBlobPath(uid), common.Sanitize(blobid))
+	uid = common.SanitizeUid(uid)
+	blobid = common.Sanitize(blobid)
+	blobPath := path.Join(fs.getUserBlobPath(uid), blobid)
 	log.Debugln("Fullpath:", blobPath)
 
 	fi, err := os.Stat(blobPath)
@@ -77,7 +79,9 @@ func (fs *FileSystemStorage) LoadBlob(uid, blobid string) (reader io.ReadCloser,
 func (fs *FileSystemStorage) StoreBlob(uid, id string, fileName string, hash string, stream io.Reader) error {
 	log.Debugf("TODO: check/save etc. write file '%s', hash '%s'", fileName, hash)
 
-	blobPath := path.Join(fs.getUserBlobPath(uid), common.Sanitize(id))
+	uid = common.SanitizeUid(uid)
+	id = common.Sanitize(id)
+	blobPath := path.Join(fs.getUserBlobPath(uid), id)
 	log.Info("Write: ", blobPath)
 	file, err := os.Create(blobPath)
 	if err != nil {

internal/storage/fs/rootstorage.go

@@ -54,6 +54,7 @@ func readRootIndex(historyPath string) (string, int64, error) {
 }
 
 func (fs *FileSystemStorage) GetRootIndex(uid string) (string, int64, error) {
+	uid = common.SanitizeUid(uid)
 	historyPath := fs.getPathFromUser(uid, historyFile)
 
 	lock, err := fslock.Lock(historyPath)
@@ -67,6 +68,7 @@ func (fs *FileSystemStorage) GetRootIndex(uid string) (string, int64, error) {
 }
 
 func (fs *FileSystemStorage) UpdateRoot(uid string, stream io.Reader, lastGen int64) (int64, error) {
+	uid = common.SanitizeUid(uid)
 	historyPath := fs.getPathFromUser(uid, historyFile)
 
 	lock, err := fslock.Lock(historyPath)
@@ -86,7 +88,8 @@ func (fs *FileSystemStorage) UpdateRoot(uid string, stream io.Reader, lastGen in
 	if currentGen > 0 {
 		rootHash, _, rootErr := readRootIndex(historyPath)
 		if rootErr == nil && rootHash != "" {
-			blobPath := path.Join(fs.getUserBlobPath(uid), common.Sanitize(rootHash))
+			rootHash = common.Sanitize(rootHash)
+			blobPath := path.Join(fs.getUserBlobPath(uid), rootHash)
 			_, blobErr := os.Stat(blobPath)
 			rootExists = blobErr == nil
 		}

internal/ui/handlers.go

@@ -32,9 +32,7 @@ const (
 )
 
 func userID(c *gin.Context) string {
-	//TODO: suppress the warning
-	//codeql[go/path-injection]
-	return c.GetString(userIDContextKey)
+	return common.SanitizeUid(c.GetString(userIDContextKey))
 }
 
 func (app *ReactAppWrapper) register(c *gin.Context) {