Add tests

Also fixed a sibling directory that matches the prefix.

1 files changed, 3 insertions, 3 deletions

diff --git a/Jellyfin.Api/Controllers/HlsSegmentController.cs b/Jellyfin.Api/Controllers/HlsSegmentController.cs
index 4cb7627559..c61ee45830 100644
--- a/Jellyfin.Api/Controllers/HlsSegmentController.cs
+++ b/Jellyfin.Api/Controllers/HlsSegmentController.cs
@@ -164,10 +164,10 @@ public class HlsSegmentController : BaseJellyfinApiController
 
     private string? ValidateTranscodePath(string filename)
     {
-        var transcodePath = _serverConfigurationManager.GetTranscodePath();
+        var transcodePath = Path.TrimEndingDirectorySeparator(Path.GetFullPath(_serverConfigurationManager.GetTranscodePath()));
         var file = Path.GetFullPath(filename, transcodePath);
-        var fileDir = Path.GetDirectoryName(file);
-        if (string.IsNullOrEmpty(fileDir) || !fileDir.StartsWith(transcodePath, StringComparison.OrdinalIgnoreCase))
+        // Require a separator after the transcode path so a sibling like "<transcodePath>-evil" can't pass.
+        if (!file.StartsWith(transcodePath + Path.DirectorySeparatorChar, StringComparison.OrdinalIgnoreCase))
         {
             return null;
         }