Ban leading tildedelete-site-rpc

2 files changed, 2 insertions, 1 deletions

diff --git a/internal/service/deploy/deploy.go b/internal/service/deploy/deploy.go
index 936c2807..ac0e2452 100644
--- a/internal/service/deploy/deploy.go
+++ b/internal/service/deploy/deploy.go
@@ -46,7 +46,7 @@ func validatePath(requestPath string) error {
 		return status.Errorf(codes.InvalidArgument, "invalid path: %q", requestPath)
 	}
 
-	if strings.HasPrefix(requestPath, ".") || strings.HasPrefix(requestPath, "/") {
+	if strings.IndexAny(requestPath, "./~") == 0 {
 		return status.Errorf(codes.InvalidArgument, "invalid path: %q", requestPath)
 	}
 
diff --git a/internal/service/deploy/deploy_test.go b/internal/service/deploy/deploy_test.go
index 967c9c47..156e333c 100644
--- a/internal/service/deploy/deploy_test.go
+++ b/internal/service/deploy/deploy_test.go
@@ -100,6 +100,7 @@ func TestDeleteSiteFail(t *testing.T) {
 		{desc: "traversal end", path: "foo/bar/..", code: codes.InvalidArgument},
 		{desc: "path starting with period", path: ".foo/bar", code: codes.InvalidArgument},
 		{desc: "path starting with slash", path: "/foo/bar", code: codes.InvalidArgument},
+		{desc: "path starting with tilde", path: "~/foo/bar", code: codes.InvalidArgument},
 		{desc: "directory does not exist", path: "does/not/exist", code: codes.FailedPrecondition},
 		{desc: "path is a file not a directory", path: path.Join(sitePath, "hello"), code: codes.FailedPrecondition},
 	}