From 50976575e130b09ebc031d084f8613d3689e79fd Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Sat, 7 Mar 2026 09:19:33 -0800
Subject: [PATCH] Web: allow wildcard local media roots

---
 src/web/media.ts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/web/media.ts b/src/web/media.ts
index 1e0842bb750..e82005f7a75 100644
--- a/src/web/media.ts
+++ b/src/web/media.ts
@@ -12,6 +12,7 @@ import {
   optimizeImageToPng,
   resizeToJpeg,
 } from "../media/image-ops.js";
+import { isInboundPathAllowed } from "../media/inbound-path-policy.js";
 import { getDefaultMediaLocalRoots } from "../media/local-roots.js";
 import { detectMime, extensionForMime, kindFromMime } from "../media/mime.js";
 import { resolveUserPath } from "../utils.js";
@@ -115,6 +116,12 @@ async function assertLocalMediaAllowed(
     }
   }
   for (const root of roots) {
+    if (root.includes("*")) {
+      if (isInboundPathAllowed({ filePath: resolved, roots: [root] })) {
+        return;
+      }
+      continue;
+    }
     let resolvedRoot: string;
     try {
       resolvedRoot = await fs.realpath(root);