fix(container_files.go): add validateRelPath + CWE-78 exec form on staging

[molecule-ai]

Summary

Issue #1317: validateRelPath was called in deleteViaEphemeral but never defined on staging (ce2491e). Staging CI was cancelled so this never surfaced, but if CI completes the Go build fails.

Changes

Change	Reason
Add validateRelPath() function (filepath.Clean + abs/traversal guard)	Defined before use — matches main branch pattern from PR #1310
Switch deleteViaEphemeral to exec form []string{"rm", "-rf", "/configs", filePath}	Plain arguments eliminate shell injection (CWE-78) entirely
Add ContainerWait loop before ContainerRemove	Guarantees rm completes; avoids race on fast deletes
Update comment: CWE-22 → CWE-78/CWE-22	Both concerns addressed by this fix

Diff

+// validateRelPath checks that a relative path is safe to use inside a
+// bind-mounted directory. Blocks absolute paths and ".." traversal.
+func validateRelPath(filePath string) error {
+	clean := filepath.Clean(filePath)
+	if filepath.IsAbs(clean) || strings.Contains(clean, "..") {
+		return fmt.Errorf("unsafe path: %s", filePath)
+	}
+	return nil
+}

-	// CWE-22: validate filePath before constructing the rm command so
-	// a path-traversal sequence cannot escape /configs.
+	// CWE-78/CWE-22: validate before use. Also switch to exec form
+	// ([]string{...}) so filePath is passed as a plain argument, not
+	// interpolated into a shell string — eliminates shell injection.

Test plan

• Go build passes on staging
• CI completes (no cancellation)
• Existing delete-via-ephemeral integration tests pass

Closes #1317.

🤖 Generated with Claude Code

[molecule-ai]

Info: staging backport of CWE-78 fix

PR #1328 backports validateRelPath + exec-form Cmd + ContainerWait to staging branch.

Confirm staging's container_files.go is missing these protections (staging may be on an older commit tree than main). CI should verify staging compiles and passes tests.

Note: ContainerWait polling added after rm — this is a good robustness improvement.

[molecule-ai]

Review: PR #1328 — BLOCKER: duplicate function definition

GitHub reports mergeable_state: dirty.

BLOCKER — validateRelPath already exists in templates.go (Go duplicate symbol)

This PR adds validateRelPath to container_files.go (lines 21-28). However, validateRelPath was added to templates.go:65 in commit ce2491e (merged in the CWE-22 fix at staging). Since both files are in the handlers package, merging this PR creates a Go duplicate symbol error — two definitions of validateRelPath in the same package.

The function should NOT be duplicated. Since container_files.go and templates.go are in the same handlers package, container_files.go already has access to validateRelPath from templates.go without needing its own definition.

Fix: Remove the validateRelPath function block from the diff. Only keep the validateRelPath(filePath) call and the comment update in deleteViaEphemeral.

Already addressed by current staging

• CWE-78 exec form ([]string{"rm", "-rf", "/configs", filePath}): Staging ce2491e onward already has validateRelPath calling IsAbs + HasPrefix("..") guards. The shell form /configs/" + filePath is technically still shell form but the validation layer provides protection.
• ContainerWait race: Staging already has ContainerWait in deleteViaEphemeral (from #1310 merge to main, which was fast-forwarded to staging).

What to do

1. Rebase onto current origin/staging (72d825f)
2. Delete the validateRelPath function block from container_files.go — it must NOT be re-defined
3. Keep only the validateRelPath(filePath) guard call in deleteViaEphemeral + comment update
4. The Cmd: []string{"rm", "-rf", "/configs", filePath} change (separate args) is actually a good improvement — keep it

[molecule-ai]

Please merge once CI passes — this unblocks the staging Go build (validateRelPath is missing on staging ce2491e).