feat(Validators): add server ID validation function to prevent path traversal and unsafe characters; update routes to utilize new validation logic

backend/routes/serverConfigsRoutes.js

@@ -10,6 +10,7 @@ const { sendError, sendOk, checkIfNoneMatch } = require('../middleware/errorHand
 const { GetObjectCommand, HeadObjectCommand } = require('@aws-sdk/client-s3');
 const { streamToString } = require('../services/s3Service');
 const { getS3TextWithHeaders, getS3JsonWithHeaders } = require('../utils/s3Helpers');
+const { isValidServerId } = require('../lib/validators');
 
 const S3_KEY = 'servers.json';
 
@@ -143,9 +144,19 @@ const serverConfigsListRoutes = {
   post: postServerConfigsList
 };
 
+function validateServerIdParam(req, res) {
+  const serverId = req.params?.serverId;
+  if (!serverId || !isValidServerId(serverId)) {
+    sendError(res, 400, 'Invalid serverId: only alphanumeric, dot, dash, underscore allowed', 'E_BAD_REQUEST');
+    return null;
+  }
+  return serverId;
+}
+
 // GET /api/server-configs/:serverId (конкретная конфигурация)
 async function getServerConfig(req, res) {
-  const { serverId } = req.params;
+  const serverId = validateServerIdParam(req, res);
+  if (serverId === null) return;
   await getS3TextWithHeaders(
     `filter-manager/config-${serverId}.txt`,
     req,
@@ -159,7 +170,8 @@ async function getServerConfig(req, res) {
 
 // POST /api/server-configs/:serverId (сохранить конфигурацию)
 async function postServerConfig(req, res) {
-  const { serverId } = req.params;
+  const serverId = validateServerIdParam(req, res);
+  if (serverId === null) return;
   const { config } = req.body;
   
   if (!config) {
@@ -177,7 +189,8 @@ async function postServerConfig(req, res) {
 
 // DELETE /api/server-configs/:serverId (удалить только конфигурацию)
 async function deleteServerConfig(req, res) {
-  const { serverId } = req.params;
+  const serverId = validateServerIdParam(req, res);
+  if (serverId === null) return;
   
   try {
     await deleteS3Object(`filter-manager/config-${serverId}.txt`);
@@ -191,7 +204,8 @@ async function deleteServerConfig(req, res) {
 
 // DELETE /api/server-configs/:serverId/complete (удалить конфигурацию и фильтры)
 async function deleteServerComplete(req, res) {
-  const { serverId } = req.params;
+  const serverId = validateServerIdParam(req, res);
+  if (serverId === null) return;
   
   try {
     await Promise.allSettled([
@@ -208,7 +222,8 @@ async function deleteServerComplete(req, res) {
 
 // GET /api/server-filters/:serverId
 async function getServerFilters(req, res) {
-  const { serverId } = req.params;
+  const serverId = validateServerIdParam(req, res);
+  if (serverId === null) return;
   await getS3JsonWithHeaders(
     `filter-manager/server-filters-${serverId}.json`,
     req,
@@ -219,7 +234,8 @@ async function getServerFilters(req, res) {
 
 // POST /api/server-filters/:serverId
 async function postServerFilters(req, res) {
-  const { serverId } = req.params;
+  const serverId = validateServerIdParam(req, res);
+  if (serverId === null) return;
   const { filters } = req.body;
   
   if (!Array.isArray(filters)) {