refactor: use filepath.Rel for path containment checks per review

Replace string HasPrefix checks with isWithinDir helper using
filepath.Rel for more robust cross-platform containment validation.

Author: skyoo2003

internal/services/ecr/store.go

@@ -19,6 +19,23 @@ import (
 	"github.com/skyoo2003/devcloud/internal/storage/sqlite"
 )
 
+// isWithinDir returns true if child resolves to a path within parent.
+func isWithinDir(child, parent string) bool {
+	absChild, err := filepath.Abs(filepath.Clean(child))
+	if err != nil {
+		return false
+	}
+	absParent, err := filepath.Abs(filepath.Clean(parent))
+	if err != nil {
+		return false
+	}
+	rel, err := filepath.Rel(absParent, absChild)
+	if err != nil {
+		return false
+	}
+	return rel != ".." && !strings.HasPrefix(rel, ".."+string(filepath.Separator)) && !filepath.IsAbs(rel)
+}
+
 var (
 	ErrRepositoryNotFound      = errors.New("repository not found")
 	ErrRepositoryAlreadyExists = errors.New("repository already exists")
@@ -404,9 +421,8 @@ func (s *ECRStore) UploadLayerPart(accountID, repoName, uploadID string, partFir
 
 	// Save blob to filesystem.
 	dir := filepath.Join(s.dataDir, "_layers", uploadID, "parts")
-	cleaned := filepath.Clean(dir)
-	if !strings.HasPrefix(cleaned, filepath.Clean(s.dataDir)+string(filepath.Separator)) {
-		return fmt.Errorf("path traversal detected: %s", cleaned)
+	if !isWithinDir(dir, s.dataDir) {
+		return fmt.Errorf("path traversal detected: %s", dir)
 	}
 	if err := os.MkdirAll(dir, 0o755); err != nil {
 		return fmt.Errorf("mkdir layer parts: %w", err)

internal/services/lambda/store.go

@@ -153,6 +153,23 @@ func isSafePathComponent(v string) bool {
 		!strings.ContainsAny(v, "/\\")
 }
 
+// isWithinDir returns true if child resolves to a path within parent.
+func isWithinDir(child, parent string) bool {
+	absChild, err := filepath.Abs(filepath.Clean(child))
+	if err != nil {
+		return false
+	}
+	absParent, err := filepath.Abs(filepath.Clean(parent))
+	if err != nil {
+		return false
+	}
+	rel, err := filepath.Rel(absParent, absChild)
+	if err != nil {
+		return false
+	}
+	return rel != ".." && !strings.HasPrefix(rel, ".."+string(filepath.Separator)) && !filepath.IsAbs(rel)
+}
+
 // codePath returns the filesystem path for a function's code zip.
 // It validates that accountID and functionName are single path segments and that
 // the resolved path stays within s.codeDir to prevent path traversal.
@@ -196,7 +213,7 @@ func (s *LambdaStore) CreateFunction(info *FunctionInfo, codeZip []byte) (*Funct
 		return nil, err
 	}
 	dir := filepath.Dir(path)
-	if !strings.HasPrefix(filepath.Clean(dir), filepath.Clean(s.codeDir)+string(filepath.Separator)) {
+	if !isWithinDir(dir, s.codeDir) {
 		return nil, fmt.Errorf("path traversal detected: %s", dir)
 	}
 	if err := os.MkdirAll(dir, 0o755); err != nil {
@@ -414,7 +431,7 @@ func (s *LambdaStore) UpdateFunctionCode(accountID, functionName string, codeZip
 		return nil, err
 	}
 	dir := filepath.Dir(path)
-	if !strings.HasPrefix(filepath.Clean(dir), filepath.Clean(s.codeDir)+string(filepath.Separator)) {
+	if !isWithinDir(dir, s.codeDir) {
 		return nil, fmt.Errorf("path traversal detected: %s", dir)
 	}
 	if err := os.MkdirAll(dir, 0o755); err != nil {

internal/services/s3/provider.go

@@ -26,6 +26,23 @@ import (
 	"github.com/skyoo2003/devcloud/internal/plugin"
 )
 
+// isWithinDir returns true if child resolves to a path within parent.
+func isWithinDir(child, parent string) bool {
+	absChild, err := filepath.Abs(filepath.Clean(child))
+	if err != nil {
+		return false
+	}
+	absParent, err := filepath.Abs(filepath.Clean(parent))
+	if err != nil {
+		return false
+	}
+	rel, err := filepath.Rel(absParent, absChild)
+	if err != nil {
+		return false
+	}
+	return rel != ".." && !strings.HasPrefix(rel, ".."+string(filepath.Separator)) && !filepath.IsAbs(rel)
+}
+
 const defaultAccountID = plugin.DefaultAccountID
 
 // S3Provider implements plugin.ServicePlugin using FileStore and MetadataStore.
@@ -470,11 +487,10 @@ func (p *S3Provider) multipartDir(uploadID string) (string, error) {
 		return "", fmt.Errorf("invalid upload id")
 	}
 	dir := filepath.Join(p.fileStore.baseDir, "_multipart", uploadID)
-	cleaned := filepath.Clean(dir)
-	if !strings.HasPrefix(cleaned, filepath.Clean(p.fileStore.baseDir)+string(filepath.Separator)) {
+	if !isWithinDir(dir, p.fileStore.baseDir) {
 		return "", fmt.Errorf("path traversal detected in multipart dir")
 	}
-	return cleaned, nil
+	return filepath.Clean(dir), nil
 }
 
 // partPath returns the path to a specific part file.