Documentation
¶
Overview ¶
Package safepath is the one way a path this tool COMPUTED is removed. It exists because a reaper glob, a lane flag, a slot directory and a job directory are all paths the tool derived rather than paths a person is deleting by hand, and a wrong derivation must not be able to remove an arbitrary directory: this removal is one mistake away from deleting the whole disk.
RemoveUnder removes a path only when it is STRICTLY below a root the caller names. It refuses an empty root or path, a root that is the whole disk or the user's home, a path equal to its root, a path that resolves outside its root once symlinks are followed, and a path that is itself a symlink. The removal is the caller's one allowed os.RemoveAll; no other package removes a computed path directly.
The hygiene verbs use the second door, RemoveUnderRoots: it is the same removal check reached through a small set of literal roots, with a ".." element refused before anything resolves and no element left non-writable. The path is never built from user text, it is the join of a literal root and a name, and the check is by construction rather than by a caller's care.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrUnsafe = errors.New("refusing to remove an unsafe path")
ErrUnsafe wraps every refusal, so a caller can say "this was a refusal, not an I/O failure" without reading the message.
Functions ¶
func NameOK ¶
NameOK reports whether s is one safe path element: not empty, not "." or "..", no slash, not starting with "-", and only [A-Za-z0-9._-].
func RemoveUnder ¶
RemoveUnder removes path when it is strictly below root.
func RemoveUnderRoots ¶
RemoveUnderRoots removes path when it is strictly below one of roots. It is the only rm in the hygiene verbs; a refusal names the path and the reason.
func ResolvedUnder ¶
ResolvedUnder returns path with symlinks resolved when it is strictly below root (also resolved for symlinks). A path with a ".." element, a path that is itself a symlink, and a path that resolves outside root are all refused.
Types ¶
type Policy ¶
Policy configures the environmental boundaries for path removal. The zero value uses os.UserHomeDir and standard path resolution.
func (Policy) RemoveUnder ¶
RemoveUnder removes path, which must sit strictly below root. It is os.RemoveAll with the one question that matters answered first: can this path escape the root a person named? A path that does not exist is nothing to remove and returns nil.
root and path may be relative; they are made absolute against the process's own directory, the same directory the caller would have opened them from. Symlinks are followed on BOTH sides before the containment test, so a link cannot smuggle a path outside its root, and the path itself may not be a link: removing a link removes only the link, but a link where a directory was expected is a derivation the tool must not act on.
Source Files