make kestrel a tak server, so that it can send and receive pois as cots data

server/api/me/avatar.get.js

@@ -8,8 +8,15 @@ const MIME = Object.freeze({ jpg: 'image/jpeg', jpeg: 'image/jpeg', png: 'image/
 export default defineEventHandler(async (event) => {
   const user = requireAuth(event)
   if (!user.avatar_path) throw createError({ statusCode: 404, message: 'No avatar' })
-  const path = join(getAvatarsDir(), user.avatar_path)
-  const ext = user.avatar_path.split('.').pop()?.toLowerCase()
+  
+  // Validate avatar path to prevent path traversal attacks
+  const filename = user.avatar_path
+  if (!filename || !/^[a-f0-9-]+\.(jpg|jpeg|png)$/i.test(filename)) {
+    throw createError({ statusCode: 400, message: 'Invalid avatar path' })
+  }
+  
+  const path = join(getAvatarsDir(), filename)
+  const ext = filename.split('.').pop()?.toLowerCase()
   const mime = MIME[ext] ?? 'application/octet-stream'
   try {
     const buf = await readFile(path)