safepath

func Contains ¶ added in v0.4.6

func Contains(root, target string) bool

Contains reports whether target lies within root. Both must already be absolute and symlink-resolved by the caller; Contains is pure (no I/O) and only does the algebraic containment check (filepath.Rel + the same `..`-prefix test SafeJoin uses). root == target counts as contained. Used by the kustomize remote-base copy to confine a symlink's resolved target to the base root.

func Escaped ¶ added in v0.4.6

func Escaped(rel string) bool

Escaped reports whether a filepath.Rel result escapes its base: the rel is exactly ".." or begins with a ".." path component (OS separator). It is the shared containment predicate used by SafeJoin, Contains, and callers that keep the rel string but must reject repo/root escapes.

func SafeJoin ¶

func SafeJoin(base, rel string, rejectAbsolute bool) (string, error)

SafeJoin joins base and rel, verifying that the resulting path stays strictly inside base. It defends against two escape shapes:

• Relative traversal: `../../escape.txt` — filepath.Clean collapses the dots; Rel then reports a `..` prefix which is rejected.
• Absolute path: `/etc/passwd` — rejected before the Join when rejectAbsolute is true (tar-header callers). When rejectAbsolute is false (bucket-key callers), filepath.Join's component-boundary handling silently strips the leading slash and keeps the result inside base; Rel still validates containment after the join.

The rejectAbsolute flag exists because the two callers differ in semantics:

• OCI tar extraction (rejectAbsolute = true): a tar header with an absolute path (e.g. `/etc/passwd`) is a sign of a malicious archive; it must be rejected, not silently redirected.
• Bucket key download (rejectAbsolute = false): bucket object names are not filesystem paths; an object literally named "/etc/passwd" is contained safely by filepath.Join and should not error.

Returns the cleaned absolute path on success, or an error if the path would escape base.