fix: handle server error messages and validate instance ID

- Check message type before parsing to handle 'error' responses
- Add validation to prevent path traversal via instance ID

Author: rgarcia

lib/cp.go

@@ -253,6 +253,22 @@ func copyFileToWs(ws WsConn, srcPath string, size int64, callbacks *CpCallbacks)
 		return fmt.Errorf("read result: %w", err)
 	}
 
+	// Check message type first - server may send error or result
+	var msgType struct {
+		Type string `json:"type"`
+	}
+	if err := json.Unmarshal(message, &msgType); err != nil {
+		return fmt.Errorf("parse message type: %w", err)
+	}
+
+	if msgType.Type == "error" {
+		var errMsg cpError
+		if err := json.Unmarshal(message, &errMsg); err != nil {
+			return fmt.Errorf("parse error: %w", err)
+		}
+		return fmt.Errorf("copy failed: %s", errMsg.Message)
+	}
+
 	var result cpResult
 	if err := json.Unmarshal(message, &result); err != nil {
 		return fmt.Errorf("parse result: %w", err)
@@ -285,6 +301,22 @@ func copyDirToWs(ctx context.Context, cfg CpConfig, ws WsConn, srcPath, dstPath,
 		return fmt.Errorf("read result: %w", err)
 	}
 
+	// Check message type first - server may send error or result
+	var msgType struct {
+		Type string `json:"type"`
+	}
+	if err := json.Unmarshal(message, &msgType); err != nil {
+		return fmt.Errorf("parse message type: %w", err)
+	}
+
+	if msgType.Type == "error" {
+		var errMsg cpError
+		if err := json.Unmarshal(message, &errMsg); err != nil {
+			return fmt.Errorf("parse error: %w", err)
+		}
+		return fmt.Errorf("copy failed: %s", errMsg.Message)
+	}
+
 	var result cpResult
 	if err := json.Unmarshal(message, &result); err != nil {
 		return fmt.Errorf("parse result: %w", err)
@@ -573,6 +605,14 @@ func sanitizePath(base, path string) (string, error) {
 
 // buildWsURL builds the WebSocket URL for the cp endpoint
 func buildWsURL(baseURL, instanceID string) (string, error) {
+	// Validate instanceID to prevent path traversal attacks
+	if instanceID == "" {
+		return "", fmt.Errorf("instance ID cannot be empty")
+	}
+	if strings.Contains(instanceID, "/") || strings.Contains(instanceID, "\\") || strings.Contains(instanceID, "..") {
+		return "", fmt.Errorf("invalid instance ID: contains path separator or traversal sequence")
+	}
+
 	u, err := url.Parse(baseURL)
 	if err != nil {
 		return "", fmt.Errorf("invalid base URL: %w", err)