fix(serve): validate config_path from env var (CodeQL path traversal)

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "codesearch"
-version = "1.0.71"
+version = "1.0.72"
 edition = "2021"
 authors = ["codesearch contributors"]
 license = "Apache-2.0"

src/db_discovery/repos.rs

@@ -235,7 +235,18 @@ pub fn config_dir() -> Result<PathBuf> {
 
 pub fn config_path() -> Result<PathBuf> {
     if let Ok(override_path) = std::env::var(crate::constants::REPOS_CONFIG_ENV) {
-        return Ok(PathBuf::from(override_path));
+        let path = PathBuf::from(&override_path);
+        // Validate the env-var override points to a .json file to prevent
+        // path traversal / arbitrary file read (CodeQL: uncontrolled data in path).
+        let ext = path.extension().and_then(|e| e.to_str()).unwrap_or("");
+        if ext.eq_ignore_ascii_case("json") {
+            return Ok(path);
+        }
+        anyhow::bail!(
+            "{} must point to a .json file, got: {}",
+            crate::constants::REPOS_CONFIG_ENV,
+            override_path
+        );
     }
     Ok(config_dir()?.join(REPOS_CONFIG_FILE))
 }

src/serve/mod.rs

@@ -195,6 +195,13 @@ impl ServeState {
             },
         };
 
+        // Canonicalize to resolve symlinks and prevent path traversal.
+        // CodeQL: path derives from env var (CODESEARCH_REPOS_CONFIG) — validate before use.
+        let config_path = match std::fs::canonicalize(&config_path) {
+            Ok(p) => p,
+            Err(_) => return Ok(()), // file doesn't exist yet — nothing to reload
+        };
+
         let mtime = std::fs::metadata(&config_path)
             .and_then(|m| m.modified())
             .ok();