Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ResolveExistingPrefix ¶ added in v0.29.0
resolveExistingPrefix resolves symlinks in path for a write-style check where path itself (and possibly several trailing components) may not exist yet. It walks up from path until it finds the nearest ancestor that does exist, resolves that ancestor's symlinks, and rejoins the not-yet-existing suffix onto the resolved ancestor.
A single level of "check the immediate parent" is not enough: creating a new file several directories deep in one call (a fresh extraction directory, a multi-level config path) means neither the file nor its immediate parent exist yet, so stopping at one level silently falls back to the unresolved, uncleaned path — which can either wrongly deny a legitimate nested path (e.g. on a host where an allowed directory itself sits under a symlink, such as macOS's /tmp -> /private/tmp) or, more importantly, wrongly ALLOW a path where an intermediate, not-yet-visible component is actually a symlink that escapes the allowed directories. Walking to the nearest existing ancestor closes both gaps at every depth, not just one level. ResolveExistingPrefix resolves the longest existing prefix of absPath through symlinks; it is exported for os.symlink target validation.
Types ¶
type Config ¶
type Config struct {
// AllowedPaths is a list of absolute directory paths that file operations are restricted to.
// If nil, all paths are allowed (no restrictions).
// If empty slice (not nil), no paths are allowed (deny all).
// All paths must be absolute and will be cleaned/normalized.
AllowedPaths []string
}
Config holds the configuration for file system security
func (*Config) IsPathAllowed ¶
IsPathAllowed checks if the given path is within the allowed paths. Returns true if the path is allowed, false otherwise.
SECURITY CRITICAL: This function prevents path traversal attacks. It handles: - Relative paths (./foo, ../foo) - Path traversal (../../etc/passwd) - Symlink attacks (by evaluating the real path) - Prefix attacks (/allowed vs /allowed-other)
Source Files