Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrPathNotAllowed = errors.New("path is outside allowed directories")
ErrPathNotAllowed is the error a path outside the allowed paths wraps.
Functions ¶
func NormalizeAllowedPaths ¶ added in v0.33.0
NormalizeAllowedPaths makes every entry absolute and clean, relative to the working directory now, as each library does when it is registered. IsPathAllowed compares absolute resolved paths, so a relative entry (".", "./data", a script's own directory) would otherwise never match. Nil (no restriction) stays nil and an empty slice (deny all) stays empty; an entry that cannot be made absolute is dropped.
func RawDir ¶ added in v0.33.0
RawDir returns path without its final element, like filepath.Dir but without cleaning: filepath.Dir("a/l/../b/f") is "a/b", which the kernel resolves differently from the "a/l/../b" that opening the path walks through when l is a symlink. Creating RawDir(path) with os.MkdirAll therefore makes only directories that checking path with IsPathAllowed has already walked. It returns "." for a path with no separator.
func ResolveExistingPrefix ¶ added in v0.29.0
ResolveExistingPrefix resolves absPath through symlinks as ResolvePath does, returning absPath unchanged when it cannot be resolved (a symlink loop).
func ResolvePath ¶ added in v0.33.0
ResolvePath resolves an absolute path the way the kernel does when it is opened: component by component, following each symlink (a relative target from the link's own directory) before applying any later "..". Unlike filepath.EvalSymlinks it also resolves paths that do not fully exist: a dangling symlink is followed to where it points, and a component that does not exist is taken as the plain directory os.MkdirAll would create there, so a later ".." pops it and later symlinks are still followed. It reports false for a symlink loop.
Types ¶
type Config ¶
type Config struct {
// AllowedPaths is a list of absolute directory paths that file operations are restricted to.
// If nil, all paths are allowed (no restrictions).
// If empty slice (not nil), no paths are allowed (deny all).
// All paths must be absolute and will be cleaned/normalized.
AllowedPaths []string
}
Config holds the configuration for file system security
func (*Config) CheckPath ¶ added in v0.33.0
CheckPath returns a *DeniedError when path is outside the allowed paths, nil otherwise. A nil Config allows everything.
func (*Config) IsPathAllowed ¶
IsPathAllowed checks if the given path is within the allowed paths. Returns true if the path is allowed, false otherwise.
SECURITY CRITICAL: This function prevents path traversal attacks. It handles: - Relative paths (./foo, ../foo) - Path traversal (../../etc/passwd) - Symlink attacks (by evaluating the real path) - Prefix attacks (/allowed vs /allowed-other)
type DeniedError ¶ added in v0.33.0
type DeniedError struct {
Path string
}
DeniedError reports a path outside the allowed paths. It wraps ErrPathNotAllowed, so callers that turn Go errors into script errors can raise it as a PermissionError.
func (*DeniedError) Error ¶ added in v0.33.0
func (e *DeniedError) Error() string
func (*DeniedError) Unwrap ¶ added in v0.33.0
func (e *DeniedError) Unwrap() error
Source Files