Function is_normalized_zone_dir 

pub fn is_normalized_zone_dir(path: &str) -> bool

Returns true if path is an absolute, fully-normalized directory path.

“Fully-normalized” means the path is absolute and contains no .. (parent-directory) or . (current-directory) components — exactly the shape that resolve_zone_dir guarantees at startup.

Why this exists

The configured zone directory is canonicalized once at startup, but it is read back inside HTTP handlers through the axum State extractor. CodeQL (rust/path-injection) models any value reaching a handler via State as untrusted, so it re-taints the already-safe path where it feeds a filesystem sink (e.g. tokio::fs::metadata in the readiness probe, tokio::fs::read_dir when listing zones). Calling this guard immediately before such a sink is a defense-in-depth barrier: it re-asserts the resolve_zone_dir invariant at the point of use and rejects any path that is unexpectedly relative or contains traversal components, rather than touching an unintended location on the filesystem.

Guard shape (required)

CodeQL’s barrier guard is intra-procedural and only takes effect when the guard is an early return that leaves the sink in straight-line code, paired with an inline contains("..") check:

if !is_normalized_zone_dir(dir) || dir.contains("..") {
    return /* not ready / error */;
}
// sink here, in straight-line code
tokio::fs::read_dir(dir).await

Writing the same condition as if bad { .. } else { /* sink */ } does not sanitize the flow — that shape left the readiness probe flagged as code-scanning alert #7 on PR #114, while the early-return form in list_zones cleared. Keep guard and sink in the same function; calling this helper from a caller of the sink’s function does not count.

Arguments

• path - The configured zone directory path to check.

Returns

true if the path is absolute and free of ../. components, else false.