Uncontrolled data used in path expression

[antonym]

Potential fix for https://github.com/netbootxyz/webapp/security/code-scanning/6

To fix the problem, we need to ensure that the filename is validated and sanitized before being used to construct file paths. We can achieve this by normalizing the path and ensuring it is contained within the intended directory. We will use the path module to resolve the path and check that it starts with the root directory.

1. Normalize the filename using path.resolve to remove any .. segments.
2. Check that the normalized path starts with the intended root directory.
3. If the path is invalid, return an error or handle it appropriately.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.