Harden Windows package paths (T-605)

core/catalog/parser.go

@@ -9,12 +9,12 @@ import (
 	"fmt"
 	"io"
 	"net/url"
-	"path"
 	"regexp"
 	"strings"
 	"time"
 
 	"softbox.local/core/domain"
+	"softbox.local/core/internal/safepath"
 )
 
 var (
@@ -163,8 +163,12 @@ func validateApp(app App) error {
 	if len(app.Architectures) == 0 {
 		return invalidField("architectures", "must not be empty")
 	}
-	if !validSafeRelativePath(app.EntryEXE) {
-		return invalidField("entry_exe", "must be a safe relative path")
+	if err := safepath.ValidateRelative(app.EntryEXE); err != nil {
+		return invalidField(
+			"entry_exe",
+			"must be a safe Windows relative path: %v",
+			err,
+		)
 	}
 	if len(app.Packages) == 0 {
 		return invalidField("packages", "must not be empty")
@@ -261,18 +265,6 @@ func validateHTTPSURL(value string) error {
 	return nil
 }
 
-func validSafeRelativePath(value string) bool {
-	if value == "" || strings.Contains(value, `\`) || strings.Contains(value, ":") {
-		return false
-	}
-	cleaned := path.Clean(value)
-	return cleaned == value &&
-		cleaned != "." &&
-		!strings.HasPrefix(cleaned, "/") &&
-		cleaned != ".." &&
-		!strings.HasPrefix(cleaned, "../")
-}
-
 func invalidField(field, format string, values ...any) error {
 	return fmt.Errorf(
 		"%w: %s: %s",