fix: secure join path

Author: ItsNotGoodName

go.mod

@@ -6,6 +6,7 @@ require (
 	github.com/Rican7/lieut v0.1.1
 	github.com/a-h/templ v0.2.334
 	github.com/containrrr/shoutrrr v0.8.0
+	github.com/cyphar/filepath-securejoin v0.2.4
 	github.com/dustin/go-humanize v1.0.1
 	github.com/emersion/go-sasl v0.0.0-20220912192320-0145f2c60ead
 	github.com/emersion/go-smtp v0.18.1

go.sum

@@ -16,6 +16,8 @@ github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7
 github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
+github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg=
+github.com/cyphar/filepath-securejoin v0.2.4/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

internal/endpoint/schema.go

@@ -2,11 +2,11 @@ package endpoint
 
 import (
 	"fmt"
-	"path"
 
 	"github.com/ItsNotGoodName/smtpbridge/internal/models"
 	"github.com/ItsNotGoodName/smtpbridge/internal/senders"
 	"github.com/containrrr/shoutrrr"
+	securejoin "github.com/cyphar/filepath-securejoin"
 )
 
 var Schema models.EndpointSchema = models.EndpointSchema{
@@ -100,7 +100,11 @@ func (s Factory) build(kind string, config models.EndpointConfig) (Sender, error
 	case "apprise":
 		return senders.NewApprise(s.pythonExecutable, s.appriseScriptPath, config.StrSlice("urls")), nil
 	case "script":
-		scriptPath := path.Join(s.scriptDirectory, config.Str("file"))
+		scriptPath, err := securejoin.SecureJoin(s.scriptDirectory, config.Str("file"))
+		if err != nil {
+			return nil, err
+		}
+
 		return senders.NewScript(scriptPath), nil
 	default:
 		return nil, errInvalidSenderKind