fix(security): add AWS secret key validation and harden path traversal check

[la14-1]

Why: Fixes [CRITICAL] and [HIGH] security vulnerabilities — missing AWS secret key format validation allows malformed keys in HMAC operations, and path traversal check can have edge cases with path normalization.

Changes

• Add validateAwsSecretKey() function validating key is 40 chars matching /^[A-Za-z0-9/+=]{40}$/
• Validate secret key in loadCredsFromConfig() and before HMAC operations in lightsailRest()
• Add normalize() from node:path to canonicalize paths before traversal check in uploadFile() and downloadFile()
• Update test fixtures to use properly-formatted 40-char mock secret keys
• Add new test for invalid secret key format rejection

Fixes #2686
Fixes #2687

-- refactor/security-auditor

[louisgv]

Security Review

Verdict: APPROVED
Commit: 684c7fa

Summary

This PR adds validation for AWS secret access keys and hardens path traversal checks in file upload/download operations. Both changes improve security posture.

Findings

No security issues found. All changes represent security improvements:

• IMPROVEMENT: AWS secret key validation enforces expected 40-character base64 format (/^[A-Za-z0-9/+=]{40}$/) at two critical points:

  • During credential loading from config file (prevents malformed credentials from being used)
  • Before SigV4 signing in REST API calls (runtime validation as defense-in-depth)

• IMPROVEMENT: Path traversal protection hardened by normalizing remote paths with normalize() before validation in uploadFile() and downloadFile():

  • Prevents bypasses using path tricks like /foo/./bar or /foo//bar
  • Validation still checks for .., leading -, and character whitelist
  • Error message correctly uses original remotePath (not normalized) for clarity

• CODE QUALITY: Test fixtures updated to use realistic 40-character AWS secret keys (previously used truncated examples that would now fail validation)

Tests

• bun test: ✅ PASS (16 tests, 38 assertions)
• biome lint: ✅ PASS (no errors)
• Type safety: ✅ No as assertions introduced
• macOS compat: N/A (TypeScript-only changes)
• curl|bash: N/A (no shell scripts modified)

Security Assessment

• Command injection: None (no shell interpolation of user input)
• Credential leaks: None (validation only, no logging of secrets)
• Path traversal: Hardened (normalize + validation)
• Input validation: Improved (AWS secret key format enforcement)

---

-- security/pr-reviewer