Enforce fs source containment

internal/validate/standard_validator.go

@@ -12,6 +12,7 @@ import (
 	"strings"
 
 	"gitea.maximumdirect.net/eric/scriptorium/internal/domain"
+	"gitea.maximumdirect.net/eric/scriptorium/internal/filecatalog"
 	"github.com/santhosh-tekuri/jsonschema/v6"
 )
 
@@ -244,17 +245,24 @@ func (v *FSValidator) resolveSchemaPath(schemaPath string) (string, error) {
 		return "", errors.New("schema filesystem is nil")
 	}
 
-	cleanRoot := cleanFSRoot(v.root)
+	cleanRoot := filecatalog.CleanFSRoot(v.root)
 	rootInfo, err := fs.Stat(v.fsys, cleanRoot)
 	if err != nil {
 		return "", fmt.Errorf("failed to access schema source %q: %w", cleanRoot, err)
 	}
 
-	cleanSchemaPath := cleanSchemaFSPath(schemaPath)
 	var resolved string
 	if rootInfo.IsDir() {
-		resolved = path.Join(cleanRoot, cleanSchemaPath)
+		resolvedPath, _, err := filecatalog.ResolveFSPath(cleanRoot, cleanRoot, schemaPath)
+		if err != nil {
+			return "", err
+		}
+		resolved = resolvedPath
 	} else {
+		cleanSchemaPath, err := cleanSchemaFSPath(schemaPath)
+		if err != nil {
+			return "", err
+		}
 		if cleanSchemaPath != path.Base(cleanRoot) {
 			return "", fmt.Errorf("schema path %q does not match schema file %q", cleanSchemaPath, path.Base(cleanRoot))
 		}
@@ -267,18 +275,16 @@ func (v *FSValidator) resolveSchemaPath(schemaPath string) (string, error) {
 	return resolved, nil
 }
 
-func cleanSchemaFSPath(schemaPath string) string {
+func cleanSchemaFSPath(schemaPath string) (string, error) {
 	cleaned := strings.TrimSpace(schemaPath)
-	cleaned = strings.TrimPrefix(path.Clean(cleaned), "/")
-	return cleaned
-}
-
-func cleanFSRoot(root string) string {
-	root = strings.TrimSpace(root)
-	if root == "" || root == "." {
-		return "."
+	if cleaned == "" {
+		return "", errors.New("schema path is required for json_schema validation")
 	}
-	return strings.TrimPrefix(path.Clean(root), "/")
+	cleaned = path.Clean(cleaned)
+	if path.IsAbs(cleaned) {
+		return "", fmt.Errorf("schema path %q must be relative", schemaPath)
+	}
+	return cleaned, nil
 }
 
 func fsSchemaResourceURL(schemaName string) string {