Path validation in upload

[harminius]

Resolves https://github.com/MerginMaps/server-private/issues/2724

Problem:
Filepath can be manipulated during the upload which breaks the project manipulation and is also a potential vulnerability 🪄

Solution:
Validate file path at the beginning of the upload - block absolute paths and those including ./, .\

🛡️

These paths are included in the test:

filepaths = [
    ("/home/user/mm/project/survey.gpkg", False),
    ("C:\Documents\Summer2018.pdf", False),
    ("\Desktop\Summer2019.pdf", False),
    ("../image.png", False),
    ("./image.png", False),
    ("assets/photos/im?age.png", False),
    ("assets/photos/CON.png", False),
    ("assets/photos/CONfile.png", True),
    ("image.png", True),
    ("images/image.png", True),
    ("media/photos/image.png", True),
    ("med..ia/pho.tos/ima...ge.png", True),
]

[coveralls]

Pull Request Test Coverage Report for Build 13240086351

Details

• 23 of 23 (100.0%) changed or added relevant lines in 4 files are covered.
• 2 unchanged lines in 1 file lost coverage.
• Overall coverage increased (+0.02%) to 93.233%

---

Files with Coverage Reduction	New Missed Lines	%
server/mergin/sync/public_api_controller.py	2	91.71%

Totals
Change from base Build 13114400777:	0.02%
Covered Lines:	6710
Relevant Lines:	7197

---

💛 - Coveralls