eric/notarius
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Reject backslashes in confined file paths

Browse Source
This commit is contained in:
Eric Rakestraw
2026-07-18 13:36:10 +00:00
parent 47bacc7abb
commit 9746a42e04
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
internal/core/fileio/fileio.go
View File

@@ -19,7 +19,7 @@ func SafePath(root, name string) (string, error) {
if name == "" { if name == "" {
return "", fmt.Errorf("artifact name must not be empty") return "", fmt.Errorf("artifact name must not be empty")
} }
if strings.Contains(name, `\\`) { if strings.ContainsRune(name, '\\') {
return "", fmt.Errorf("artifact name %q must use slash-separated relative paths", name) return "", fmt.Errorf("artifact name %q must use slash-separated relative paths", name)
} }
if path.IsAbs(name) || filepath.IsAbs(name) { if path.IsAbs(name) || filepath.IsAbs(name) {

2
internal/core/fileio/fileio_test.go
View File

@@ -8,7 +8,7 @@ import (
) )
func TestSafePathRejectsUnsafeNames(t *testing.T) { func TestSafePathRejectsUnsafeNames(t *testing.T) {
for _, name := range []string{"/tmp/x", "a/../x", "a//x", `a\\x`} { for _, name := range []string{"/tmp/x", "a/../x", "a//x", `a\x`, `a\\x`} {
if _, err := SafePath(t.TempDir(), name); err == nil { if _, err := SafePath(t.TempDir(), name); err == nil {
t.Fatalf("SafePath(%q) accepted unsafe path", name) t.Fatalf("SafePath(%q) accepted unsafe path", name)
} }