Fix external library path validation #8319 (#8366)

* Fix isImmichPath

* prettier write

* Fis isImmichPath code comment

* Refactor isImmichPath function based on team suggestions

* Test isImmichPath

* fix: clean comments

* Refactor isImmichPath test based on team suggestions

* Clean code with lintern suggestions

server/src/cores/storage.core.spec.ts

@@ -0,0 +1,29 @@
+import { StorageCore } from 'src/cores/storage.core';
+
+jest.mock('src/constants', () => ({
+  APP_MEDIA_LOCATION: '/photos',
+}));
+
+describe('StorageCore', () => {
+  describe('isImmichPath', () => {
+    it('should return true for APP_MEDIA_LOCATION path', () => {
+      const immichPath = '/photos';
+      expect(StorageCore.isImmichPath(immichPath)).toBe(true);
+    });
+
+    it('should return true for paths within the APP_MEDIA_LOCATION', () => {
+      const immichPath = '/photos/new/';
+      expect(StorageCore.isImmichPath(immichPath)).toBe(true);
+    });
+
+    it('should return false for paths outside the APP_MEDIA_LOCATION and same starts', () => {
+      const nonImmichPath = '/photos_new';
+      expect(StorageCore.isImmichPath(nonImmichPath)).toBe(false);
+    });
+
+    it('should return false for paths outside the APP_MEDIA_LOCATION', () => {
+      const nonImmichPath = '/some/other/path';
+      expect(StorageCore.isImmichPath(nonImmichPath)).toBe(false);
+    });
+  });
+});

server/src/cores/storage.core.ts

@@ -115,7 +115,13 @@ export class StorageCore {
   }
 
   static isImmichPath(path: string) {
-    return resolve(path).startsWith(resolve(APP_MEDIA_LOCATION));
+    const resolvedPath = resolve(path);
+    const resolvedAppMediaLocation = resolve(APP_MEDIA_LOCATION);
+    const normalizedPath = resolvedPath.endsWith('/') ? resolvedPath : resolvedPath + '/';
+    const normalizedAppMediaLocation = resolvedAppMediaLocation.endsWith('/')
+      ? resolvedAppMediaLocation
+      : resolvedAppMediaLocation + '/';
+    return normalizedPath.startsWith(normalizedAppMediaLocation);
   }
 
   static isGeneratedAsset(path: string) {