support creating from rest logs

[ozkeisar]

No description provided.

To fix the issue, we need to ensure that presetFolder.filename is sanitized or validated before being used to construct the file path. Since the filename is expected to be a simple name without path components, we can use the sanitize-filename npm package to remove any special characters or path traversal sequences. This will ensure that the constructed file path remains within the intended directory.

Steps to fix:

1. Install the sanitize-filename package if it is not already installed.
2. Import the sanitize-filename package in src/backend/utils/presetHelpers.ts.
3. Use sanitizeFilename to sanitize presetFolder.filename before constructing the file path in the savePresetFolder function.

---

To fix the issue, we need to prevent prototype pollution by ensuring that user-controlled keys cannot modify Object.prototype. This can be achieved by:

1. Using a Map instead of a plain object for presetsHash, as Map does not inherit from Object.prototype and is immune to prototype pollution.
2. Alternatively, creating a prototype-less object using Object.create(null) for presetsHash ensures that it does not inherit from Object.prototype.

The best approach here is to use Object.create(null) for presetsHash to minimize changes to the existing codebase while addressing the vulnerability.

---

To fix the issue, we need to ensure that keys assigned to server.parentRoutesHash are sanitized to prevent prototype-polluting keys like __proto__, constructor, or prototype. This can be achieved by validating the newParent.id before using it as a key. If the key is invalid, we should throw an error or handle it appropriately.

The best approach is to add a utility function to validate keys and use it in the ensureParentExists function. This ensures that only safe keys are used in the assignment.

---