Bound external result file reads

internal/adapters/notarius/subprocess.go

@@ -5,12 +5,12 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"io"
 	"os"
 	"path/filepath"
 	"strings"
 
 	"gitea.maximumdirect.net/eric/narratio/internal/adapters/subprocess"
+	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
 	"gitea.maximumdirect.net/eric/narratio/internal/pathsafe"
 )
 
@@ -388,32 +388,9 @@ func loadWarnings(path string) ([]WarningSummary, error) {
 }
 
 func decodeBoundedJSON(path string, limit int64, destination any) error {
-	inspected, err := os.Lstat(path)
+	data, err := fileops.ReadRegularFile(path, limit)
 	if err != nil {
-		return err
-	}
-	if inspected.Mode()&os.ModeSymlink != 0 || !inspected.Mode().IsRegular() {
-		return fmt.Errorf("path %q must be a regular file without symlinks", path)
-	}
-	file, err := os.Open(path)
-	if err != nil {
-		return err
-	}
-	defer func() { _ = file.Close() }()
-	opened, err := file.Stat()
-	if err != nil {
-		return err
-	}
-	if !opened.Mode().IsRegular() || !os.SameFile(inspected, opened) {
-		return fmt.Errorf("file %q changed before it could be read", path)
-	}
-	reader := io.LimitReader(file, limit+1)
-	data, err := io.ReadAll(reader)
-	if err != nil {
-		return err
-	}
-	if int64(len(data)) > limit {
-		return fmt.Errorf("file %q exceeds %d-byte limit", path, limit)
+		return fmt.Errorf("notarius JSON result exceeds or cannot be read within %d-byte limit: %w", limit, err)
 	}
 	if err := json.Unmarshal(data, destination); err != nil {
 		return err