Documentation
¶
Overview ¶
Package sanitize is the L1 ingest filter for uploaded editions: cheap structural checks that the bytes match the declared format and aren't a zip bomb or polyglot. It does not strip active content (PDF JavaScript, EPUB scripts) — that's L2, a separate package when we add it.
Validate is called from the upload handler before the file is content- addressed and streamed to storage. It takes a ReadSeeker (multipart.File satisfies this) so EPUB validation can read the zip central directory at the file's tail without buffering the whole upload in memory.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( ErrUnsupportedFormat = errors.New("unsupported format") ErrFormatMismatch = errors.New("file content does not match declared format") ErrInvalidContent = errors.New("file content is invalid for declared format") ErrZipBomb = errors.New("archive exceeds safety limits") // ErrActiveContent fires when an upload contains scripting or other // active payloads we won't carry: scripts in an EPUB, embedded // executables, etc. PDFs don't return this — they're silently stripped // in Sanitize. Maps to HTTP 400 at the handler. ErrActiveContent = errors.New("file contains active content (scripts, executables, etc.)") )
Functions ¶
func Sanitize ¶
Sanitize is L2: produce a safe-to-store version of an already-Validated upload. For PDFs we re-serialize with active content (JavaScript actions, embedded files, XFA forms, etc.) stripped; the returned reader holds bytes that differ from the input — the new sha256 is what gets stored. For EPUBs we strict-reject any script-bearing entry and pass through otherwise. For TXTs there's nothing to do — passthrough.
rs must be seeked to 0 (Validate leaves it there on success). On success the returned reader is positioned at 0 and the caller streams it into storage exactly the way it would have streamed the original.
func Validate ¶
func Validate(format string, rs io.ReadSeeker, size int64) error
Validate checks that rs's bytes are a well-formed instance of format (case-insensitive — "pdf", "PDF", "Pdf" all accepted). On success rs is left seeked to 0 so the caller can stream it straight into storage. On failure the seek position is undefined.
size is the declared content length, used only as a hint for the EPUB reader; if you don't have it, pass -1 and the validator will Seek to discover it.
Types ¶
This section is empty.
Source Files