fix(webserver): uncontrolled data used in path expression could lead path traversal

[odaysec]

pghoard/pghoard/webserver.py

Line 514 in 2e66fbd

target_path = self.headers.get("x-pghoard-target-path")

pghoard/pghoard/webserver.py

Line 554 in 2e66fbd

shutil.copyfile(xlog_path, target_path)

Fix the issue need to ensure that target_path is validated before it is used in shutil.copyfile. The validation should:

1. Normalize the path using os.path.normpath to remove any .. segments.
2. Ensure that the normalized path is within a predefined safe directory (e.g., the PostgreSQL data directory or another controlled directory).

The _validate_target_path method should be updated (or implemented if missing) to perform these checks. Additionally, we should ensure that target_path is only used after it has been validated.

---

References

Path Traversal
werkzeug.utils.secure_filename
CWE-22
CWE-23
CWE-36
CWE-73
CWE-99