feat(metadata): add safe path validation

pages/api/metadata/[...params].js

@@ -1,14 +1,21 @@
-import { GFW_DATA_API, GFW_STAGING_DATA_API } from 'utils/apis';
+import { GFW_DATA_API } from 'utils/apis';
 import axios from 'axios';
 
-const ENVIRONMENT = process.env.NEXT_PUBLIC_FEATURE_ENV;
-const GFW_METADATA_API_URL =
-  ENVIRONMENT === 'staging' ? GFW_STAGING_DATA_API : GFW_DATA_API;
-
 export default async (req, res) => {
   try {
-    const path = req.query.params.join('/');
-    const url = `${GFW_METADATA_API_URL}/${path}`;
+    const allowedPaths = {
+      [`dataset/${req.query.params[1]}`]: `dataset/${req.query.params[1]}`,
+    };
+
+    const userPath = req.query.params.join('/');
+    const safePath = allowedPaths[userPath];
+
+    if (!safePath) {
+      return res.status(400).end('Invalid path');
+    }
+
+    const url = `${GFW_DATA_API}/${safePath}`;
+
     const datasetMetadata = await axios.get(url);
     const datasetVersionMetadata = await axios.get(`${url}/latest/metadata`);