security: project and service names not validated — path traversal possible

[samsonajulor]

Summary

Project names (quikdb-frame init <name>) and service names (quikdb-frame add <type> <name>) are used directly in filepath.Join without validation. A malicious name like ../../etc can write files outside the intended directory.

Vulnerable code

cmd/quikdb-frame/main.go

case "init":
    name := os.Args[2]  // no validation
    // passed directly to scaffold.Init(name, ...) → os.MkdirAll(name, ...)

internal/scaffold/add.go

fullPath := filepath.Join("services", svcName)  // svcName unchecked
os.MkdirAll(fullPath, 0755)

Fix

Validate name against a strict allowlist before any file operations:

var validName = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9_-]{0,49}$`)

if !validName.MatchString(name) {
    return fmt.Errorf("invalid name %q: use letters, numbers, hyphens, underscores only", name)
}

Severity

HIGH — arbitrary directory creation outside project root.