all: use securejoin

appview/pages/templates/knots.html

···
 
     <section class="mb-12">
         <h3 class="text-xl font-semibold mb-4">my knots</h3>
+        <p>This is a list of knots</p>
         <ul id="my-knots" class="space-y-6">
             {{ range .Registrations }}
                 {{ if .Registered }}

appview/state/repo.go

···
 	"io"
 	"log"
 	"net/http"
-	"path/filepath"
 
 	"github.com/bluesky-social/indigo/atproto/identity"
+	securejoin "github.com/cyphar/filepath-securejoin"
 	"github.com/go-chi/chi/v5"
 	"github.com/sotangled/tangled/appview/auth"
 	"github.com/sotangled/tangled/appview/pages"
···
 }
 
 func (f *FullyResolvedRepo) OwnerSlashRepo() string {
-	return filepath.Join(f.OwnerDid(), f.RepoName)
+	p, _ := securejoin.SecureJoin(f.OwnerDid(), f.RepoName)
+	return p
 }
 
 func fullyResolvedRepo(r *http.Request) (*FullyResolvedRepo, error) {

appview/state/state.go

···
 	"fmt"
 	"log"
 	"net/http"
-	"path/filepath"
 	"strings"
 	"time"
 
···
 	"github.com/bluesky-social/indigo/atproto/syntax"
 	lexutil "github.com/bluesky-social/indigo/lex/util"
 	"github.com/bluesky-social/jetstream/pkg/models"
+	securejoin "github.com/cyphar/filepath-securejoin"
 	"github.com/go-chi/chi/v5"
 	tangled "github.com/sotangled/tangled/api/tangled"
 	"github.com/sotangled/tangled/appview"
···
 		}
 
 		// acls
-		err = s.enforcer.AddRepo(user.Did, domain, filepath.Join(user.Did, repoName))
+		p, _ := securejoin.SecureJoin(domain, repoName)
+		err = s.enforcer.AddRepo(user.Did, domain, p)
 		if err != nil {
 			s.pages.Notice(w, "repo", "Failed to set up repository permissions.")
 			return

cmd/repoguard/main.go

···
 	"net/url"
 	"os"
 	"os/exec"
-	"path/filepath"
 	"strings"
 	"time"
 
+	securejoin "github.com/cyphar/filepath-securejoin"
 	"github.com/sotangled/tangled/appview"
 )
 
···
 	didOrHandle := components[0]
 	did := resolveToDid(didOrHandle)
 	repoName := components[1]
-	qualifiedRepoName := filepath.Join(did, repoName)
+	qualifiedRepoName, _ := securejoin.SecureJoin(did, repoName)
 
 	validCommands := map[string]bool{
 		"git-receive-pack":   true,
···
 		}
 	}
 
-	fullPath := filepath.Join(*baseDirFlag, qualifiedRepoName)
-	fullPath = filepath.Clean(fullPath)
+	fullPath, _ := securejoin.SecureJoin(*baseDirFlag, qualifiedRepoName)
 
 	logEvent("Processing command", map[string]interface{}{
 		"user":     *incomingUser,

go.mod

···
 	github.com/bluesky-social/indigo v0.0.0-20250123072624-9e3b84fdbb20
 	github.com/bluesky-social/jetstream v0.0.0-20241210005130-ea96859b93d1
 	github.com/casbin/casbin/v2 v2.103.0
+	github.com/cyphar/filepath-securejoin v0.3.3
 	github.com/dustin/go-humanize v1.0.1
 	github.com/gliderlabs/ssh v0.3.5
 	github.com/go-chi/chi/v5 v5.2.0
···
 	github.com/casbin/govaluate v1.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cloudflare/circl v1.4.0 // indirect
-	github.com/cyphar/filepath-securejoin v0.3.3 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect

knotserver/git.go

···
 	"net/http"
 	"path/filepath"
 
+	securejoin "github.com/cyphar/filepath-securejoin"
 	"github.com/go-chi/chi/v5"
 	"github.com/sotangled/tangled/knotserver/git/service"
 )
···
 func (d *Handle) InfoRefs(w http.ResponseWriter, r *http.Request) {
 	did := chi.URLParam(r, "did")
 	name := chi.URLParam(r, "name")
-	repo := filepath.Join(d.c.Repo.ScanPath, did, name)
+	repo, _ := securejoin.SecureJoin(d.c.Repo.ScanPath, filepath.Join(did, name))
 
 	w.Header().Set("content-type", "application/x-git-upload-pack-advertisement")
 	w.WriteHeader(http.StatusOK)
···
 func (d *Handle) UploadPack(w http.ResponseWriter, r *http.Request) {
 	did := chi.URLParam(r, "did")
 	name := chi.URLParam(r, "name")
-	repo := filepath.Join(d.c.Repo.ScanPath, did, name)
+	repo, _ := securejoin.SecureJoin(d.c.Repo.ScanPath, filepath.Join(did, name))
 
 	w.Header().Set("content-type", "application/x-git-upload-pack-result")
 	w.Header().Set("Connection", "Keep-Alive")

knotserver/routes.go

···
 	"strconv"
 	"strings"
 
+	securejoin "github.com/cyphar/filepath-securejoin"
 	"github.com/gliderlabs/ssh"
 	"github.com/go-chi/chi/v5"
 	"github.com/go-git/go-git/v5/plumbing"
···
 }
 
 func (h *Handle) RepoIndex(w http.ResponseWriter, r *http.Request) {
-	path := filepath.Join(h.c.Repo.ScanPath, didPath(r))
+	path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r))
 	l := h.l.With("path", path, "handler", "RepoIndex")
 
 	gr, err := git.Open(path, "")
···
 
 	l := h.l.With("handler", "RepoTree", "ref", ref, "treePath", treePath)
 
-	path := filepath.Join(h.c.Repo.ScanPath, didPath(r))
+	path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r))
 	gr, err := git.Open(path, ref)
 	if err != nil {
 		notFound(w)
···
 
 	l := h.l.With("handler", "FileContent", "ref", ref, "treePath", treePath)
 
-	path := filepath.Join(h.c.Repo.ScanPath, didPath(r))
+	path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r))
 	gr, err := git.Open(path, ref)
 	if err != nil {
 		notFound(w)
···
 	setContentDisposition(w, filename)
 	setGZipMIME(w)
 
-	path := filepath.Join(h.c.Repo.ScanPath, didPath(r))
+	path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r))
 	gr, err := git.Open(path, ref)
 	if err != nil {
 		notFound(w)
···
 
 func (h *Handle) Log(w http.ResponseWriter, r *http.Request) {
 	ref := chi.URLParam(r, "ref")
-	path := filepath.Join(h.c.Repo.ScanPath, didPath(r))
+	path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r))
 
 	l := h.l.With("handler", "Log", "ref", ref, "path", path)
 
···
 
 	l := h.l.With("handler", "Diff", "ref", ref)
 
-	path := filepath.Join(h.c.Repo.ScanPath, didPath(r))
+	path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r))
 	gr, err := git.Open(path, ref)
 	if err != nil {
 		notFound(w)
···
 }
 
 func (h *Handle) Tags(w http.ResponseWriter, r *http.Request) {
-	path := filepath.Join(h.c.Repo.ScanPath, didPath(r))
+	path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r))
 	l := h.l.With("handler", "Refs")
 
 	gr, err := git.Open(path, "")
···
 }
 
 func (h *Handle) Branches(w http.ResponseWriter, r *http.Request) {
-	path := filepath.Join(h.c.Repo.ScanPath, didPath(r))
+	path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r))
 	l := h.l.With("handler", "Branches")
 
 	gr, err := git.Open(path, "")
···
 	name := data.Name
 
 	relativeRepoPath := filepath.Join(did, name)
-	repoPath := filepath.Join(h.c.Repo.ScanPath, relativeRepoPath)
+	repoPath, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, relativeRepoPath)
 	err := git.InitBare(repoPath)
 	if err != nil {
 		l.Error("initializing bare repo", "error", err.Error())
···
 	}
 	h.jc.AddDid(data.Did)
 
-	repoName := filepath.Join(ownerDid, repo)
+	repoName, _ := securejoin.SecureJoin(ownerDid, repo)
 	if err := h.e.AddCollaborator(data.Did, ThisServer, repoName); err != nil {
 		l.Error("adding repo collaborator", "error", err.Error())
 		writeError(w, err.Error(), http.StatusInternalServerError)

knotserver/util.go

···
 	"os"
 	"path/filepath"
 
+	securejoin "github.com/cyphar/filepath-securejoin"
 	"github.com/go-chi/chi/v5"
 	"github.com/microcosm-cc/bluemonday"
 )
···
 func didPath(r *http.Request) string {
 	did := chi.URLParam(r, "did")
 	name := chi.URLParam(r, "name")
-	path := filepath.Join(did, name)
+	path, _ := securejoin.SecureJoin(did, name)
 	filepath.Clean(path)
 	return path
 }