fix: validate mailing list name to prevent path traversal (CM-1318)

Signed-off-by: Uroš Marolt <uros@marolt.me>

Author: themarolt

backend/src/api/integration/helpers/mailingListAuthenticate.ts

@@ -5,11 +5,26 @@ import IntegrationService from '../../../services/integrationService'
 import PermissionChecker from '../../../services/user/permissionChecker'
 import { validateOrThrow } from '../../../utils/validation'
 
+const MAX_LIST_NAME_LENGTH = 255
+
+// `name` becomes a single filesystem path component for the mailing list
+// mirror (see mirror_service.py's list_mirror_dir), so it must not contain a
+// path separator or resolve to "." / ".." when used alone.
+const isSafeListName = (name: string): boolean =>
+  name.length > 0 &&
+  name.length <= MAX_LIST_NAME_LENGTH &&
+  !name.includes('/') &&
+  !name.includes('\0') &&
+  name !== '.' &&
+  name !== '..'
+
 const bodySchema = z.object({
   lists: z
     .array(
       z.object({
-        name: z.string().trim().min(1),
+        name: z.string().trim().min(1).refine(isSafeListName, {
+          message: 'Invalid mailing list name',
+        }),
         sourceUrl: z.string().trim().min(1),
       }),
     )

services/apps/mailing_list_integration/src/crowdmail/services/mirror/mirror_service.py

@@ -14,6 +14,7 @@
     NetworkError,
     RateLimitError,
     RemoteServerError,
+    ValidationError,
 )
 from crowdmail.logger import logger
 from crowdmail.services.parse.noteren import get_email_from_git, git_run_command
@@ -75,8 +76,29 @@ async def _run_shell_command(cmd: list[str], cwd: str | None = None, timeout: fl
     return ""
 
 
+MAX_LIST_NAME_LENGTH = 255
+
+
+def _validate_list_name(list_name: str) -> None:
+    """Reject anything that could escape the mirror root as a path component.
+
+    `list_name` becomes a single os.path.join component (no separators
+    allowed), so the only way it can resolve outside `mirror_dir` is by being
+    exactly "." or "..". Everything else is a literal directory name.
+    """
+    if (
+        not list_name
+        or len(list_name) > MAX_LIST_NAME_LENGTH
+        or "/" in list_name
+        or "\0" in list_name
+        or list_name in (".", "..")
+    ):
+        raise ValidationError(f"Invalid mailing list name: {list_name!r}")
+
+
 def list_mirror_dir(list_name: str, mirror_dir: str = LORE_MIRROR_DIR) -> str:
     """Local directory where a lore list mirror lives."""
+    _validate_list_name(list_name)
     return os.path.join(mirror_dir, list_name)