fix: address review findings — sendfile EINTR, path traversal check

src/server/server.c

@@ -23,8 +23,6 @@ static bool is_excluded(const char* path, const Config* config) {
   char* path_dup = str_dup(path);
   if (!path_dup)
     return false;
-  /* basename(3) may return a pointer into path_dup or a static buffer;
-   * either way we free path_dup, not fname. */
   char* fname = basename(path_dup);
 
   // Check exclude patterns

src/shared/file.c

@@ -1,4 +1,5 @@
 #include <dirent.h>
+#include <errno.h>
 #include <fcntl.h>
 #include <libgen.h>
 #include <stddef.h>
@@ -199,10 +200,25 @@ bool file_send_single_calls(File* file, int file_descriptor, bool use_metadata,
   return true;
 }
 
+static bool has_path_traversal(const char* path) {
+  // Check if ".." appears as a path component — at start, end, or between '/'
+  const char* p = path;
+  while ((p = strstr(p, "..")) != NULL) {
+    bool at_start = (p == path);
+    bool after_slash = (p > path && p[-1] == '/');
+    bool at_end = (p[2] == '\0');
+    bool before_slash = (p[2] == '/');
+    if ((at_start || after_slash) && (at_end || before_slash))
+      return true;
+    p += 2;
+  }
+  return false;
+}
+
 bool file_save_to_disk(const char* root_directory, File* file) {
   if (file->type == FILE_TYPE_SYMLINK && file->link_target) {
     // Validate link_target — reject absolute paths or traversal
-    if (file->link_target[0] == '/' || strstr(file->link_target, "..") != NULL) {
+    if (file->link_target[0] == '/' || has_path_traversal(file->link_target)) {
       log_message(LOG_LEVEL_ERROR, "Path traversal blocked in symlink target: %s",
                   file->link_target);
       return false;
@@ -210,7 +226,7 @@ bool file_save_to_disk(const char* root_directory, File* file) {
     char* disk_path = path_cat((char*)root_directory, file->path);
     if (disk_path == NULL)
       return false;
-    if (strstr(disk_path, "..") != NULL) {
+    if (has_path_traversal(disk_path)) {
       log_message(LOG_LEVEL_ERROR, "Path traversal blocked: %s", disk_path);
       free(disk_path);
       return false;
@@ -226,7 +242,7 @@ bool file_save_to_disk(const char* root_directory, File* file) {
   char* disk_path = path_cat((char*)root_directory, file->path);
   if (disk_path == NULL)
     return false;
-  if (strstr(disk_path, "..") != NULL) {
+  if (has_path_traversal(disk_path)) {
     log_message(LOG_LEVEL_ERROR, "Path traversal blocked: %s", disk_path);
     free(disk_path);
     return false;
@@ -625,6 +641,8 @@ bool file_send_sendfile(File* file, int file_descriptor, bool use_metadata, int
   while ((unsigned long long)offset < file_size) {
     ssize_t sent = sendfile(file_descriptor, fd, &offset, file_size - offset);
     if (sent == -1) {
+      if (errno == EINTR)
+        continue;
       perror("sendfile failed");
       close(fd);
       return false;

src/shared/log.c

@@ -14,8 +14,7 @@ void log_message(LogLevel log_level, const char* format, ...) {
   if (log_level < current_log_level)
     return;
   time_t now = time(NULL);
-  struct tm result_buf;
-  const struct tm* t = localtime_r(&now, &result_buf);
+  const struct tm* t = localtime(&now);
 
   fprintf(stderr, "%04d-%02d-%02d %02d:%02d:%02d [%s]: ", t->tm_year + 1900, t->tm_mon + 1,
           t->tm_mday, t->tm_hour, t->tm_min, t->tm_sec, log_level_strings[log_level]);

src/shared/transport_tcp.c

@@ -42,13 +42,14 @@ Server* server_create(int port) {
     return NULL;
   }
   memset(&server->address, 0, sizeof(server->address));
+  server->ssl_ctx = NULL;
 
   // Try IPv6 first, fall back to IPv4
-  int fd = socket(AF_INET6, SOCK_STREAM, 0);
-  sa_family_t domain = AF_INET6;
+  int domain = AF_INET6;
+  int fd = socket(domain, SOCK_STREAM, 0);
   if (fd < 0) {
-    fd = socket(AF_INET, SOCK_STREAM, 0);
     domain = AF_INET;
+    fd = socket(domain, SOCK_STREAM, 0);
   }
   if (fd < 0) {
     perror("Could not create Socket!");
@@ -63,7 +64,6 @@ Server* server_create(int port) {
   }
 
   server->file_descriptor = fd;
-  server->ssl_ctx = NULL;
   int opt = 1;
   if (setsockopt(server->file_descriptor, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt))) {
     perror("Error setting a socket option!");
@@ -72,7 +72,6 @@ Server* server_create(int port) {
     return NULL;
   }
 
-  // Use the domain from the socket we actually created
   struct sockaddr_storage* addr = &server->address;
   struct sockaddr_in* addr4 = (struct sockaddr_in*)addr;
   struct sockaddr_in6* addr6 = (struct sockaddr_in6*)addr;
@@ -81,13 +80,11 @@ Server* server_create(int port) {
     addr6->sin6_family = AF_INET6;
     addr6->sin6_addr = in6addr_any;
     addr6->sin6_port = htons(port);
-    addr->ss_family = AF_INET6;
     server->address_length = sizeof(struct sockaddr_in6);
   } else {
     addr4->sin_family = AF_INET;
     addr4->sin_addr.s_addr = INADDR_ANY;
     addr4->sin_port = htons(port);
-    addr->ss_family = AF_INET;
     server->address_length = sizeof(struct sockaddr_in);
   }
 
@@ -268,11 +265,10 @@ bool client_connect(Client* client, char* host, int port) {
   }
 
   // Save the connected address
-  socklen_t addr_len = rp->ai_addrlen;
-  if (addr_len > sizeof(client->address))
-    addr_len = sizeof(client->address);
-  memcpy(&client->address, rp->ai_addr, addr_len);
-  client->address_length = addr_len;
+  size_t copy_len =
+      rp->ai_addrlen < sizeof(client->address) ? rp->ai_addrlen : sizeof(client->address);
+  memcpy(&client->address, rp->ai_addr, copy_len);
+  client->address_length = (int)copy_len;
   freeaddrinfo(res);
 
   // Close old fd if any and set new one
@@ -303,7 +299,6 @@ void client_disconnect(Client* client) {
 void client_delete(Client* client) {
   if (client == NULL)
     return;
-  client_disconnect(client);
   if (client->ssl_ctx) {
     SSL_CTX_free(client->ssl_ctx);
     client->ssl_ctx = NULL;

tests/test_file_sendfile.c

@@ -224,7 +224,7 @@ static void test_sendfile_no_path() {
   pid_t pid = fork();
   if (pid == 0) {
     close(p[1]);
-    /* When send_path is false, the sender still sends file_type + data */
+    /* Read file type indicator */
     int file_type;
     EXPECT_TRUE(receive_int(p[0], &file_type));
     EXPECT_EQ_INT(file_type, (int)FILE_TYPE_REGULAR);

tests/test_scanner.c

@@ -248,6 +248,8 @@ static void test_scanner_max_size() {
   const char* dir = "test_scan_max";
   const char* small = "test_scan_max/small.txt";
   const char* large = "test_scan_max/large.txt";
+  create_test_file(small, "tiny");
+  create_test_file(large, "this_content_is_longer_than_ten_chars");
 
   mkdir(dir, 0755);
   create_test_file(small, "tiny");

tests/test_transport_tcp.c

@@ -9,7 +9,7 @@ static void test_client_create_delete() {
   Client* client = client_create();
   EXPECT_NOT_NULL(client);
   EXPECT_EQ_INT(client->file_descriptor, -1);
-  EXPECT_EQ_INT(client->address.ss_family, AF_UNSPEC);
+  EXPECT_TRUE(client->address.ss_family == AF_UNSPEC);
   EXPECT_EQ_INT(client->ssh_child_pid, -1);
   EXPECT_NULL(client->ssl);
   EXPECT_NULL(client->ssl_ctx);