Potential fix for code scanning alert no. 18: Uncontrolled data used in path expression

[maxirmx]

Potential fix for https://github.com/sw-consulting/media-pi.device/security/code-scanning/18

General fix: enforce a strict allowlist boundary for playlist destination paths (for example, under /var/media-pi) at input-validation time, and reject anything outside that base. Use canonical absolute paths and boundary-safe prefix checks.

Best single fix without changing intended behavior: in internal/agent/menu.go inside HandleConfigurationUpdate, after existing clean/abs/.. checks, add a containment check ensuring cleanDestination resolves under a fixed safe base directory (e.g. /var/media-pi). Use:

• safeBase := filepath.Clean("/var/media-pi")
• absSafeBase, _ := filepath.Abs(safeBase)
• absDestination, _ := filepath.Abs(cleanDestination)
• allow only if absDestination == absSafeBase or strings.HasPrefix(absDestination, absSafeBase + string(os.PathSeparator))

Then store absDestination in config (instead of cleanDestination) when calling UpdateConfigSettings.

This addresses the taint flow at the source and keeps sync.go filesystem operations safe without changing sync logic.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.