server: isAllowedPath: follow symlinks to validate the realpath

This prevents the attacker from downloading a soft symbol link first
and then use the symbol link to bypass the allowed paths validation.

server/util/fileUtil.ts

@@ -20,15 +20,30 @@ export const isAllowedPath = (resolvedPath: string) => {
   if (config.allowedPaths == null) {
     return true;
   }
+
+  let realPath: string | null = null;
+  let parentPath: string = resolvedPath;
+  while (realPath == null) {
+    try {
+      realPath = fs.realpathSync(parentPath);
+    } catch (e) {
+      if (e.code === 'ENOENT') {
+        parentPath = path.resolve(parentPath, '..');
+      } else {
+        return false;
+      }
+    }
+  }
+
   return config.allowedPaths.some((allowedPath) => {
-    if (resolvedPath.startsWith(allowedPath)) {
+    if (realPath?.startsWith(allowedPath)) {
       return true;
     }
     return false;
   });
 };
 
-export const sanitizePath = (input: string) => {
+export const sanitizePath = (input: string): string => {
   if (typeof input !== 'string') {
     throw accessDeniedError();
   }