security

package

v0.2.0 Latest Latest Go to latest Published: Jun 7, 2026 License: MIT Imports: 7 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/dobbo-ca/graphify-go

Links

Open Source Insights

Documentation ¶

Overview ¶

Package security holds the guards every piece of external input passes through: URL validation (SSRF), graph-file path containment, file-size caps, and label sanitisation. It mirrors the threat model of the Python original's graphify/security.py.

Index ¶

Constants
func CheckGraphFileSize(path string) error
func SanitizeLabel(s string) string
func ValidateGraphPath(path, base string) (string, error)
func ValidateURL(raw string) error

Constants ¶

View Source

const (
	// MaxGraphFileBytes rejects graph.json files larger than this before parsing,
	// so a crafted multi-gigabyte file cannot exhaust memory.
	MaxGraphFileBytes = 512 * 1024 * 1024
)

Variables ¶

This section is empty.

Functions ¶

func CheckGraphFileSize ¶

func CheckGraphFileSize(path string) error

CheckGraphFileSize returns an error if path exceeds MaxGraphFileBytes.

func SanitizeLabel ¶

func SanitizeLabel(s string) string

SanitizeLabel strips control characters and caps length, making a label safe to embed in JSON or plain text. For raw HTML injection, additionally escape it.

func ValidateGraphPath ¶

func ValidateGraphPath(path, base string) (string, error)

ValidateGraphPath resolves path and verifies it stays inside base (the graphify-out directory), which must exist. Prevents path traversal when a caller is handed an attacker-influenced graph path.

func ValidateURL ¶

func ValidateURL(raw string) error

ValidateURL rejects any URL that is not http/https or that resolves to a private, loopback, link-local, or cloud-metadata address (SSRF defence).

Types ¶

This section is empty.

Source Files ¶

View all Source files

security.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL