Documentation
¶
Overview ¶
Package jail resolves every client-supplied path against the configured roots. There is exactly one resolution function; every handler uses it, so path traversal, symlink escape, and denylist bypass have a single choke point to audit.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Jail ¶
type Jail struct {
// contains filtered or unexported fields
}
Jail is a resolved filesystem jail. The startup roots never change; the only mutable part is the small set of extra roots the server itself registers for directories it created (temporary clones).
func New ¶
New builds a jail from the configured roots (each resolved with EvalSymlinks at startup) plus extra denylist entries. Roots must exist and be directories.
func (*Jail) AddRoot ¶
AddRoot admits one more directory (resolved through symlinks, so a /tmp that is itself a link still matches). It is for directories the server created, never for client input; the denylist still applies beneath it. It returns the resolved path, which is also what RemoveRoot expects.
func (*Jail) RemoveRoot ¶
RemoveRoot withdraws a root added with AddRoot. Unknown roots are ignored.
func (*Jail) Resolve ¶
Resolve maps a client path to an absolute filesystem path inside the jail. It requires an absolute path, rejects NUL bytes and overlong input, resolves symlinks, verifies containment on a separator boundary, and applies the denylist. Failures are generic: callers must answer 403 without revealing whether the path exists.
Source Files