feat: stabilize local dev paths with ContentRoot-based resolution by joirunner · Pull Request #1 · OptimusPi/MotelyJAML

joirunner · 2026-01-11T17:44:44Z

Add MotelyPaths static resolver using ASP.NET Core ContentRootPath
Set ContentRoot to repo root in MotelyApiHost for consistent paths
Fix hardcoded Windows path in Endpoints.GetFilters()
Fix Filters/JamlFilters directory mismatch in FilterService
Fix WordLists/SeedSources directory mismatch in Endpoints
Replace all relative path usages with MotelyPaths properties
Add path traversal protection in FilterService.GetFilterJaml()
Support config overrides via Motely:Paths section
Add LOCAL_DEV.md documentation for path configuration

Resolves cross-platform path issues on macOS/Linux/Windows

- Add MotelyPaths static resolver using ASP.NET Core ContentRootPath - Set ContentRoot to repo root in MotelyApiHost for consistent paths - Fix hardcoded Windows path in Endpoints.GetFilters() - Fix Filters/JamlFilters directory mismatch in FilterService - Fix WordLists/SeedSources directory mismatch in Endpoints - Replace all relative path usages with MotelyPaths properties - Add path traversal protection in FilterService.GetFilterJaml() - Support config overrides via Motely:Paths section - Add LOCAL_DEV.md documentation for path configuration Resolves cross-platform path issues on macOS/Linux/Windows

Copilot

Pull request overview

This PR introduces a centralized path resolution system for Motely.API to address cross-platform path issues on macOS, Linux, and Windows. The implementation uses ASP.NET Core's ContentRootPath as the base for all directory paths, with optional configuration overrides.

Changes:

Adds MotelyPaths static class for centralized path resolution using ContentRootPath
Replaces hardcoded and relative paths with MotelyPaths properties throughout the codebase
Implements path traversal protection in FilterService.GetFilterJaml()
Adds configuration support for custom path overrides via appsettings.json

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
Motely.API/MotelyPaths.cs	New centralized path resolver with ContentRoot-based resolution and config override support
Motely.API/MotelyApiHost.cs	Sets ContentRoot to repo root and initializes MotelyPaths at startup
Motely.API/Services/FilterService.cs	Adds path traversal protection and updates to use MotelyPaths.JamlFiltersDir
Motely.API/SearchManager.cs	Updates all path references to use MotelyPaths static properties
Motely.API/Endpoints.cs	Removes hardcoded Windows path and updates to use MotelyPaths properties
Motely.API/appsettings.example.json	Adds configuration structure for path overrides
Motely.API/LOCAL_DEV.md	New documentation for local development path configuration
BalatroGameMechanicsDatasetDocum.md	Removed (appears to be unrelated documentation cleanup)

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Motely.API/Endpoints.cs

Motely.API/Services/FilterService.cs

Motely.API/MotelyPaths.cs

Motely.API/MotelyApiHost.cs

Motely.API/Services/FilterService.cs

Copilot · 2026-01-19T22:23:34Z

@joirunner I've opened a new pull request, #4, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot · 2026-01-19T22:23:45Z

@joirunner I've opened a new pull request, #5, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot · 2026-01-19T22:23:59Z

@joirunner I've opened a new pull request, #6, to work on those changes. Once the pull request is ready, I'll request review from you.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot · 2026-01-19T22:24:25Z

@joirunner I've opened a new pull request, #7, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot · 2026-01-19T22:24:42Z

@joirunner I've opened a new pull request, #8, to work on those changes. Once the pull request is ready, I'll request review from you.

[WIP] Address feedback on stabilizing local dev paths

[WIP] WIP to address feedback on local dev paths stabilization PR

Co-authored-by: joirunner <6373131+joirunner@users.noreply.github.com>

[WIP] Address feedback on local dev paths stabilization

Eliminate duplicate FindMotelyRoot() call in MotelyApiHost

Co-authored-by: joirunner <6373131+joirunner@users.noreply.github.com>

Add defense-in-depth path validation to prevent directory traversal attacks

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Motely.API/appsettings.example.json

Motely.API/MotelyPaths.cs

Motely.API/Endpoints.cs

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot · 2026-01-19T23:31:18Z

@joirunner I've opened a new pull request, #16, to work on those changes. Once the pull request is ready, I'll request review from you.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…ce condition Co-authored-by: joirunner <6373131+joirunner@users.noreply.github.com>

[WIP] Fix local dev paths stabilization with ContentRoot resolution

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-19T23:39:52Z

Motely.API/Services/FilterService.cs

+    public static bool IsPathWithinDirectory(string filePath, string baseDirectory, out string fullFilePath)
+    {
+        fullFilePath = Path.GetFullPath(filePath);
+        var fullBaseDir = Path.GetFullPath(baseDirectory);
+
+        // Normalize the directory path to end with a separator for accurate StartsWith check
+        // This prevents false positives like "/app/JamlFilters" matching "/app/JamlFiltersEvil"
+        fullBaseDir = Path.TrimEndingDirectorySeparator(fullBaseDir) + Path.DirectorySeparatorChar;
+
+        // Defense in depth: Check using both StartsWith and GetRelativePath
+        // StartsWith check: Verify the full path is within the expected directory
+        // Using Ordinal comparison for case-sensitive security on case-sensitive file systems
+        if (!fullFilePath.StartsWith(fullBaseDir, StringComparison.Ordinal))
+        {
+            return false;
+        }
+
+        // GetRelativePath check: Verify no ".." path traversal attempts
+        var relativePath = Path.GetRelativePath(fullBaseDir, fullFilePath);
+        if (relativePath.StartsWith("..", StringComparison.Ordinal) || Path.IsPathRooted(relativePath))
+        {
+            return false;
+        }
+
+        return true;
+    }
+
+    /// <summary>
+    /// Sanitizes a filter name to prevent path traversal attacks.
+    /// Extracts just the filename stem (no path separators, no extension) and replaces invalid characters.
+    /// </summary>
+    /// <param name="name">The filter name to sanitize</param>
+    /// <param name="safeName">The sanitized filename stem, or null if the name is invalid</param>
+    /// <returns>True if the name is valid and was sanitized, false otherwise</returns>
+    public static bool TrySanitizeFilterName(string? name, out string? safeName)
+    {
+        safeName = null;
+
+        if (string.IsNullOrEmpty(name))
+            return false;
+
+        // Extract just the filename stem (no path separators, no extension)
+        var sanitized = Path.GetFileNameWithoutExtension(name);
+        if (string.IsNullOrWhiteSpace(sanitized))
+            return false;
+
+        // Remove any remaining path separators or invalid characters
+        var invalidChars = Path.GetInvalidFileNameChars();
+        foreach (var c in invalidChars)
+        {
+            sanitized = sanitized.Replace(c, '_');
+        }
+
+        safeName = sanitized;
+        return true;
+    }


The new path traversal protection functions (IsPathWithinDirectory and TrySanitizeFilterName) are security-critical but lack test coverage. The repository has comprehensive test coverage for other functionality (in Motely.Tests), and these security functions should have tests verifying they correctly prevent path traversal attacks with various malicious inputs like "../", absolute paths, and edge cases on different platforms.

@copilot open a new pull request to apply changes based on this feedback

Copilot · 2026-01-19T23:39:53Z

Motely.API/MotelyPaths.cs

+        if (config != null)
+        {
+            _jamlFiltersOverride = config["Motely:Paths:JamlFiltersDir"];
+            _seedSourcesOverride = config["Motely:Paths:SeedSourcesDir"];
+            _searchResultsOverride = config["Motely:Paths:SearchResultsDir"];
+        }


The path configuration allows arbitrary absolute paths via config overrides, which could be exploited to point to sensitive system directories. Consider adding validation in Initialize to ensure configured paths are within safe boundaries or at least document this security consideration in appsettings.example.json. This is especially important since directory creation happens automatically for configured paths.

@copilot open a new pull request to apply changes based on this feedback

Copilot · 2026-01-19T23:39:53Z

Motely.API/MotelyPaths.cs

+    public static void Initialize(IWebHostEnvironment env, IConfiguration? config = null)
+    {
+        _contentRoot = env.ContentRootPath;
+
+        if (config != null)
+        {
+            _jamlFiltersOverride = config["Motely:Paths:JamlFiltersDir"];
+            _seedSourcesOverride = config["Motely:Paths:SeedSourcesDir"];
+            _searchResultsOverride = config["Motely:Paths:SearchResultsDir"];
+        }
+
+        // Ensure directories exist (using ResolvePath directly to avoid EnsureInitialized check)
+        Directory.CreateDirectory(ResolvePath(_jamlFiltersOverride, "JamlFilters"));
+        Directory.CreateDirectory(ResolvePath(_seedSourcesOverride, "SeedSources"));
+        Directory.CreateDirectory(ResolvePath(_searchResultsOverride, "SearchResults"));
+
+        // Mark as initialized after all setup is complete
+        _isInitialized = true;
+    }


The volatile keyword alone is insufficient for thread safety in the Initialize method. Multiple threads could potentially call Initialize concurrently, leading to race conditions where directories might be created multiple times or _isInitialized could be set true before all initialization is complete. Consider using a lock or Interlocked operations to ensure thread-safe initialization, or document that Initialize must only be called once from a single thread during application startup.

@copilot open a new pull request to apply changes based on this feedback

Copilot · 2026-01-19T23:48:58Z

@joirunner I've opened a new pull request, #17, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot · 2026-01-19T23:49:14Z

@joirunner I've opened a new pull request, #18, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot · 2026-01-19T23:49:25Z

@joirunner I've opened a new pull request, #19, to work on those changes. Once the pull request is ready, I'll request review from you.

Co-authored-by: joirunner <6373131+joirunner@users.noreply.github.com>

…hrows Co-authored-by: joirunner <6373131+joirunner@users.noreply.github.com>

Co-authored-by: joirunner <6373131+joirunner@users.noreply.github.com>

Add thread-safe double-checked locking to MotelyPaths.Initialize

Add test coverage for FilterService path security functions

OptimusPi · 2026-01-31T02:03:17Z

what the fuck bro

Copilot AI review requested due to automatic review settings January 11, 2026 17:44

Copilot started reviewing on behalf of joirunner January 11, 2026 17:45 View session

joirunner force-pushed the feat/stabilize-local-dev-paths branch from 0acd0f8 to bec8050 Compare January 11, 2026 17:45

joirunner force-pushed the feat/stabilize-local-dev-paths branch from bec8050 to 9d3fe04 Compare January 11, 2026 17:47

Copilot AI reviewed Jan 11, 2026

View reviewed changes

Initial plan

af3fc33

Copilot AI mentioned this pull request Jan 19, 2026

[WIP] Address feedback on stabilizing local dev paths #4

Merged

6 tasks

Initial plan

912efcb

Copilot AI mentioned this pull request Jan 19, 2026

[WIP] WIP to address feedback on local dev paths stabilization PR #5

Merged

5 tasks

Initial plan

a29a83e

Copilot AI mentioned this pull request Jan 19, 2026

[WIP] Address feedback on local dev paths stabilization #6

Merged

5 tasks

joirunner and others added 2 commits January 19, 2026 16:24

Update Motely.API/MotelyPaths.cs

91d7c4f

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Initial plan

65a8708

Copilot AI mentioned this pull request Jan 19, 2026

Eliminate duplicate FindMotelyRoot() call in MotelyApiHost #7

Merged

Initial plan

6bea872

Copilot AI mentioned this pull request Jan 19, 2026

[WIP] Update stacked PR to address feedback on local dev paths #8

Merged

6 tasks

joirunner and others added 8 commits January 19, 2026 16:25

Merge pull request #4 from OptimusPi/copilot/sub-pr-1

3c1680d

[WIP] Address feedback on stabilizing local dev paths

Merge pull request #5 from OptimusPi/copilot/sub-pr-1-again

1843263

[WIP] WIP to address feedback on local dev paths stabilization PR

Reuse motelyRoot variable instead of calling FindMotelyRoot twice

bd585e9

Co-authored-by: joirunner <6373131+joirunner@users.noreply.github.com>

Merge pull request #6 from OptimusPi/copilot/sub-pr-1-another-one

74cc0c1

[WIP] Address feedback on local dev paths stabilization

Merge pull request #7 from OptimusPi/copilot/sub-pr-1-yet-again

95c5442

Eliminate duplicate FindMotelyRoot() call in MotelyApiHost

Add path validation to FilterService.GetFilterJaml for security

848dc83

Co-authored-by: joirunner <6373131+joirunner@users.noreply.github.com>

Use normalized path consistently in File operations

72f6193

Co-authored-by: joirunner <6373131+joirunner@users.noreply.github.com>

Initial plan

0267720

Merge pull request #15 from OptimusPi/copilot/sub-pr-1-again

8a4aff4

Add defense-in-depth path validation to prevent directory traversal attacks

joirunner requested a review from Copilot January 19, 2026 23:27

Copilot started reviewing on behalf of joirunner January 19, 2026 23:27 View session

Copilot AI reviewed Jan 19, 2026

View reviewed changes

Motely.API/appsettings.example.json Outdated Show resolved Hide resolved

Motely.API/MotelyPaths.cs Outdated Show resolved Hide resolved

Motely.API/Endpoints.cs Outdated Show resolved Hide resolved

joirunner and others added 2 commits January 19, 2026 17:30

Update Motely.API/appsettings.example.json

11484c9

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Initial plan

ed9a68a

Copilot AI mentioned this pull request Jan 19, 2026

Fix memory ordering race condition in MotelyPaths initialization #16

Merged

joirunner and others added 3 commits January 19, 2026 17:32

Update Motely.API/Endpoints.cs

8154071

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Make all MotelyPaths static fields volatile to fix memory ordering ra…

4224d0c

…ce condition Co-authored-by: joirunner <6373131+joirunner@users.noreply.github.com>

Merge pull request #16 from OptimusPi/copilot/sub-pr-1-again

b10f984

[WIP] Fix local dev paths stabilization with ContentRoot resolution

joirunner requested a review from Copilot January 19, 2026 23:35

Copilot started reviewing on behalf of joirunner January 19, 2026 23:35 View session

Copilot AI reviewed Jan 19, 2026

View reviewed changes

Initial plan

22b2bd9

Copilot AI mentioned this pull request Jan 19, 2026

Add test coverage for FilterService path security functions #17

Merged

Copilot AI mentioned this pull request Jan 19, 2026

Add path validation to prevent configuration-driven access to sensitive system directories #18

Closed

Initial plan

7874dd2

Copilot AI mentioned this pull request Jan 19, 2026

Add thread-safe double-checked locking to MotelyPaths.Initialize #19

Merged

Copilot AI and others added 6 commits January 19, 2026 23:52

Add thread-safe double-checked locking to Initialize method

e69e56e

Co-authored-by: joirunner <6373131+joirunner@users.noreply.github.com>

Improve documentation and clarify atomic initialization design

dc22ba0

Co-authored-by: joirunner <6373131+joirunner@users.noreply.github.com>

Clarify EnsureInitialized documentation to indicate it verifies and t…

c2b11cf

…hrows Co-authored-by: joirunner <6373131+joirunner@users.noreply.github.com>

Add comprehensive security tests for FilterService path validation

a276850

Co-authored-by: joirunner <6373131+joirunner@users.noreply.github.com>

Merge pull request #19 from OptimusPi/copilot/sub-pr-1-one-more-time

587a40e

Add thread-safe double-checked locking to MotelyPaths.Initialize

Merge pull request #17 from OptimusPi/copilot/sub-pr-1-again

0e7ae98

Add test coverage for FilterService path security functions

OptimusPi closed this Jan 31, 2026

Conversation

joirunner commented Jan 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Jan 19, 2026

Uh oh!

Copilot AI commented Jan 19, 2026

Uh oh!

Copilot AI commented Jan 19, 2026

Uh oh!

Copilot AI commented Jan 19, 2026

Uh oh!

Copilot AI commented Jan 19, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Jan 19, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

joirunner Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

joirunner Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

joirunner Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Jan 19, 2026

Uh oh!

Copilot AI commented Jan 19, 2026

Uh oh!

Copilot AI commented Jan 19, 2026

Uh oh!

OptimusPi commented Jan 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants