Harden Windows package paths (T-605)

core/storage/installed_app.go

@@ -7,13 +7,12 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"path"
 	"path/filepath"
 	"regexp"
-	"strings"
 	"sync"
 
 	"softbox.local/core/domain"
+	"softbox.local/core/internal/safepath"
 )
 
 const (
@@ -281,12 +280,13 @@ func (record InstalledApp) validate() error {
 
 	seenPaths := make(map[string]struct{}, len(record.Files))
 	for index, installedFile := range record.Files {
-		if !validInstalledPath(installedFile.Path) {
+		if err := safepath.ValidateRelative(installedFile.Path); err != nil {
 			return fmt.Errorf(
-				"%w: files[%d].path=%q",
+				"%w: files[%d].path=%q: %v",
 				ErrInstalledAppInvalid,
 				index,
 				installedFile.Path,
+				err,
 			)
 		}
 		if installedFile.Size < 0 {
@@ -304,7 +304,7 @@ func (record InstalledApp) validate() error {
 				index,
 			)
 		}
-		foldedPath := strings.ToLower(installedFile.Path)
+		foldedPath := safepath.CollisionKey(installedFile.Path)
 		if _, exists := seenPaths[foldedPath]; exists {
 			return fmt.Errorf(
 				"%w: duplicate file path %q",
@@ -317,18 +317,6 @@ func (record InstalledApp) validate() error {
 	return nil
 }
 
-func validInstalledPath(value string) bool {
-	if value == "" || strings.Contains(value, `\`) || strings.Contains(value, ":") {
-		return false
-	}
-	cleaned := path.Clean(value)
-	return cleaned == value &&
-		cleaned != "." &&
-		!strings.HasPrefix(cleaned, "/") &&
-		cleaned != ".." &&
-		!strings.HasPrefix(cleaned, "../")
-}
-
 func requireRealDirectory(directory string) error {
 	info, err := os.Lstat(directory)
 	if err != nil {