API: Add short url validation (#38436)

* Add short url validation
Path should not contain string ../

* Update pkg/api/short_url.go

Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com>

Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com>

pkg/api/short_url.go

@@ -23,6 +23,10 @@ func (hs *HTTPServer) createShortURL(c *models.ReqContext, cmd dtos.CreateShortU
 		hs.log.Error("Invalid short URL path", "path", cmd.Path)
 		return response.Error(400, "Path should be relative", nil)
 	}
+	if strings.Contains(cmd.Path, "../") {
+		hs.log.Error("Invalid short URL path", "path", cmd.Path)
+		return response.Error(400, "Invalid path", nil)
+	}
 
 	shortURL, err := hs.ShortURLService.CreateShortURL(c.Req.Context(), c.SignedInUser, cmd.Path)
 	if err != nil {