Function is_normalized_zone_dir 

pub fn is_normalized_zone_dir(path: &str) -> bool

Returns true if path is an absolute, fully-normalized directory path.

“Fully-normalized” means the path is absolute and contains no .. (parent-directory) or . (current-directory) components — exactly the shape that resolve_zone_dir guarantees at startup.

Why this exists

The configured zone directory is canonicalized once at startup, but it is read back inside HTTP handlers through the axum State extractor. CodeQL (rust/path-injection) models any value reaching a handler via State as untrusted, so it re-taints the already-safe path where it feeds a filesystem sink (e.g. tokio::fs::metadata in the readiness probe). Calling this guard immediately before such a sink is a defense-in-depth barrier: it re-asserts the resolve_zone_dir invariant at the point of use and rejects any path that is unexpectedly relative or contains traversal components, rather than touching an unintended location on the filesystem.

Arguments

• path - The configured zone directory path to check.

Returns

true if the path is absolute and free of ../. components, else false.