Potential fix for code scanning alert no. 9: Uncontrolled data used in path expression

[jesusmpc]

Potential fix for https://github.com/InditexTech/weavejs-backend/security/code-scanning/9

General Approach:
Sanitize and validate roomId and imageId before using them to build filesystem paths. There are two principal approaches: (1) restrict roomId and imageId to simple, safe file/folder names (no slashes or special chars), or (2) use path normalization and restrict all constructed paths to a fixed root directory.

Best solution for this case:
Given the context (image storage in a /temp subdirectory), the simplest secure approach is to restrict roomId and imageId to safe filenames (no slashes, path traversal, or special characters). This can be accomplished using a library such as sanitize-filename, which removes unsafe characters. Since we are using only code shown, we'll apply a minimal regex check to only allow alphanumeric (and, optionally, - or _) characters and reject anything else. If invalid input is detected, return a 400 error.

Implementation steps:

• Insert validation code for both roomId and imageId at the start of the controller, after line 24.
• Only allow strings matching /^[a-zA-Z0-9_-]+$/ for both.
• If either is invalid, send a 400 error, do not proceed further.
• No changes to path-building logic since now both input values are sanitized and safe.
• No external dependencies required.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud