Documentation
¶
Index ¶
- Constants
- Variables
- func BirthTime(path string) (time.Time, bool, error)
- func ContentEqual(a, b string) (bool, error)
- func Identity(path string) (string, error)
- func InBasePath(basePath, path string) bool
- func IsDir(path string) bool
- func IsFile(path string) bool
- func IsIgnoredDir(name string) bool
- func IsSocket(path string) bool
- func IsSymlink(path string) bool
- func ResolveSymlinkWithin(root, path string) (string, error)
- func SyncInPlace(src, dst string) (entries, changed []string, err error)
- func VerifyAndSanitizePath(path, trustedRoot string) (string, error)
Constants ¶
const ( PermDir = 0o755 // Directory permission PermOwner = 0o600 // Owner permission PermGroup = 0o640 // Group permission PermPublic = 0o644 // Public permission PermReadOnly = 0o444 // Read-only permission )
Variables ¶
var ( ErrInvalidFilePath = errors.New("invalid file path") ErrPathTraversal = errors.New("path traversal detected") )
var IgnoreDirs = set.New(
".git",
".github",
".vscode",
".idea",
"node_modules",
)
IgnoreDirs contains directory names that should be skipped during repository walks for internal maintenance tasks (for example decrypt scans and auto-discovery scans).
Functions ¶
func BirthTime ¶ added in v0.124.0
BirthTime returns the time path was created. It reports false if the file system does not record it.
func ContentEqual ¶ added in v0.122.0
ContentEqual reports whether the file system entries at a and b have identical content.
Regular files are equal when they have the same permission bits and bytes, symlinks when they point to the same target (targets are never followed) and directories when they have the same permission bits and contain equal entries under the same names. Other file types (sockets, devices, named pipes) are never equal.
A path that is missing on one side is equal to a missing path or to a directory tree that only consists of directories on the other side. Docker creates missing bind-mount sources and mount points of nested mounts as empty directories on the host, so such a tree carries no content of its own.
func Identity ¶ added in v0.124.0
Identity returns a string that identifies the file at path: its inode number and, if the file system records it, its creation time. Both survive renaming the file, while a file re-created at the same path gets a different identity.
func InBasePath ¶ added in v0.76.0
InBasePath checks if the given path is within the base path, preventing path traversal attacks.
func IsFile ¶ added in v0.74.0
IsFile checks if the given path is a regular file without any mode bits set (like symlink, socket, named pipe, etc.).
func IsIgnoredDir ¶ added in v0.89.0
IsIgnoredDir returns true when the directory name is in IgnoreDirs.
func ResolveSymlinkWithin ¶ added in v0.122.0
ResolveSymlinkWithin returns the path that path resolves to if path itself is a symlink, like the Docker daemon does with the source of a bind mount. It fails if the symlink cannot be resolved or points outside of root. Other paths, including missing ones, are returned unchanged, since symlinks in their parent directories are followed anyway.
func SyncInPlace ¶ added in v0.122.0
SyncInPlace updates the file system tree at dst to match the tree at src, without removing entries of dst that do not exist in src.
Existing regular files are overwritten in place instead of being replaced, so their inodes are kept: a file bind-mounted into a container references the inode of its source, and replacing the file (e.g. by renaming a new file over it) would hide the new content from the container. Entries whose type differs between src and dst are replaced. Symlinks are copied, never followed. Other file types (sockets, devices, named pipes) are skipped. A missing src leaves dst untouched.
It returns the slash-separated paths relative to src ("." for src itself) of all entries copied from src, parents before their children, and of the entries it created or modified.
func VerifyAndSanitizePath ¶
VerifyAndSanitizePath checks if a file path is valid and sanitizes it.
Types ¶
This section is empty.
Source Files