Documentation
¶
Overview ¶
Package security holds the guards every piece of external input passes through: URL validation (SSRF), graph-file path containment, file-size caps, and label sanitisation. It mirrors the threat model of the Python original's graphify/security.py.
Index ¶
Constants ¶
const ( // MaxGraphFileBytes is the default cap: graph.json files larger than this are // rejected before parsing, so a crafted multi-gigabyte file cannot exhaust // memory. The effective cap is resolved at call time by maxGraphFileBytes, // which lets GRAPHIFY_MAX_GRAPH_BYTES override this default. MaxGraphFileBytes = 512 * 1024 * 1024 )
Variables ¶
This section is empty.
Functions ¶
func CheckGraphFileSize ¶
CheckGraphFileSize returns an error if path exceeds the resolved cap (see maxGraphFileBytes, honoring GRAPHIFY_MAX_GRAPH_BYTES).
func SanitizeLabel ¶
SanitizeLabel strips control characters and caps length, making a label safe to embed in JSON or plain text. For raw HTML injection, additionally escape it.
func ValidateGraphPath ¶
ValidateGraphPath resolves path and verifies it stays inside base (the graphify-out directory), which must exist. Prevents path traversal when a caller is handed an attacker-influenced graph path.
func ValidateURL ¶
ValidateURL rejects any URL that is not http/https or that resolves to a private, loopback, link-local, or cloud-metadata address (SSRF defence).
Types ¶
This section is empty.
Source Files