Address feedback from Copilot

Signed-off-by: Jonathon Anderson <janderson@ciq.com>

internal/pkg/overlay/overlay.go

@@ -100,7 +100,13 @@ func (overlay Overlay) Exists() bool {
 // Returns:
 //   - true if the overlay is a site overlay; false otherwise.
 func (overlay Overlay) IsSiteOverlay() bool {
-	return strings.Contains(overlay.Path(), config.Get().Paths.SiteOverlaydir())
+	siteDir := filepath.Clean(config.Get().Paths.SiteOverlaydir())
+	overlayPath := filepath.Clean(overlay.Path())
+	if rel, err := filepath.Rel(siteDir, overlayPath); err != nil {
+		return false
+	} else {
+		return !strings.HasPrefix(rel, "..")
+	}
 }
 
 // IsDistributionOverlay determines whether the overlay is a distribution overlay.
@@ -111,7 +117,13 @@ func (overlay Overlay) IsSiteOverlay() bool {
 // Returns:
 //   - true if the overlay is a distribution overlay; false otherwise.
 func (overlay Overlay) IsDistributionOverlay() bool {
-	return strings.Contains(overlay.Path(), config.Get().Paths.DistributionOverlaydir())
+	siteDir := filepath.Clean(config.Get().Paths.DistributionOverlaydir())
+	overlayPath := filepath.Clean(overlay.Path())
+	if rel, err := filepath.Rel(siteDir, overlayPath); err != nil {
+		return false
+	} else {
+		return !strings.HasPrefix(rel, "..")
+	}
 }
 
 func (overlay Overlay) AddFile(filePath string, content []byte, parents bool, force bool) error {

internal/pkg/warewulfd/api/overlay.go

@@ -82,14 +82,20 @@ type OverlayFile struct {
 }
 
 func (of *OverlayFile) FullPath() string {
-	myOverlay, _ := overlay.GetOverlay(of.Overlay)
+	if myOverlay, err := overlay.GetOverlay(of.Overlay); err != nil {
+		return ""
+	} else {
 		return myOverlay.File(of.Path)
 	}
+}
 
 func (of *OverlayFile) Exists() bool {
-	myOverlay, _ := overlay.GetOverlay(of.Overlay)
+	if myOverlay, err := overlay.GetOverlay(of.Overlay); err != nil {
+		return false
+	} else {
 		return myOverlay.Exists() && util.IsFile(of.FullPath())
 	}
+}
 
 func (of *OverlayFile) readContents() (string, error) {
 	fullPath := of.FullPath()
@@ -231,7 +237,10 @@ func deleteOverlay() usecase.Interactor {
 
 	u := usecase.NewInteractor(func(ctx context.Context, input deleteOverlayInput, output *OverlayResponse) error {
 		wwlog.Debug("api.deleteOverlay(Name:%v, Force:%v)", input.Name, input.Force)
-		overlay_, _ := overlay.GetOverlay(input.Name)
+		overlay_, err := overlay.GetOverlay(input.Name)
+		if err != nil {
+			return err
+		}
 		isSiteOverlay := overlay_.IsSiteOverlay()
 		if !input.Force {
 			if registry, err := node.New(); err != nil {
@@ -276,12 +285,14 @@ func deleteOverlayFile() usecase.Interactor {
 		if relPath, err := url.QueryUnescape(input.Path); err != nil {
 			return fmt.Errorf("failed to decode path: %v: %w", input.Path, err)
 		} else {
-			overlay_, _ := overlay.GetOverlay(input.Name)
-			err := overlay_.DeleteFile(relPath, input.Force, input.Cleanup)
-			if err != nil {
+			if overlay_, err := overlay.GetOverlay(input.Name); err != nil {
+				return err
+			} else {
+				if err := overlay_.DeleteFile(relPath, input.Force, input.Cleanup); err != nil {
 					return fmt.Errorf("unable to delete overlay file %v: %v: %w", input.Name, relPath, err)
 				}
 			}
+		}
 		*output = *NewOverlayResponse(input.Name)
 		return nil
 	})

internal/pkg/warewulfd/util.go

@@ -52,10 +52,11 @@ func getOverlayFile(n node.Node, context string, stage_overlays []string, autobu
 		build = util.PathIsNewer(stage_file, config.Get().Paths.NodesConf())
 
 		for _, overlayname := range stage_overlays {
-			myOverlay, _ := overlay.GetOverlay(overlayname)
+			if myOverlay, err := overlay.GetOverlay(overlayname); err == nil {
 				build = build || util.PathIsNewer(stage_file, myOverlay.Rootfs())
 			}
 		}
+	}
 
 	if build {
 		registry, err := node.New()