security: harden WebDAV overwrite and multi-root routing

chfs-ng/internal/storage/multipath.go

@@ -3,6 +3,7 @@ package storage
 import (
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"time"
 )
@@ -23,15 +24,9 @@ func NewMulti(paths []string) Multi {
 		if name == "." || name == string(filepath.Separator) || name == "" {
 			name = "root"
 		}
-		duplicate := false
-		for _, existing := range m.Names {
-			if existing == name {
-				duplicate = true
-				break
-			}
-		}
-		if duplicate {
-			continue
+		base := name
+		for i := 2; containsString(m.Names, name); i++ {
+			name = base + "-" + strconv.Itoa(i)
 		}
 		m.Roots = append(m.Roots, Local{Root: abs})
 		m.Names = append(m.Names, name)
@@ -39,6 +34,15 @@ func NewMulti(paths []string) Multi {
 	return m
 }
 
+func containsString(items []string, want string) bool {
+	for _, item := range items {
+		if item == want {
+			return true
+		}
+	}
+	return false
+}
+
 func (m Multi) isVirtualRoot(p string) bool { return strings.Trim(p, "/") == "" }
 
 func (m Multi) FindRoot(p string) (string, string, bool) {

chfs-ng/internal/storage/multipath_test.go

@@ -0,0 +1,26 @@
+package storage
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestNewMultiKeepsDuplicateBasenames(t *testing.T) {
+	root := t.TempDir()
+	first := filepath.Join(root, "same")
+	second := filepath.Join(root, "other", "same")
+	if err := os.MkdirAll(first, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(second, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	m := NewMulti([]string{first, second})
+	if len(m.Roots) != 2 || len(m.Names) != 2 {
+		t.Fatalf("duplicate basename dropped: roots=%d names=%v", len(m.Roots), m.Names)
+	}
+	if m.Names[0] != "same" || m.Names[1] != "same-2" {
+		t.Fatalf("unexpected virtual names: %v", m.Names)
+	}
+}