Documentation
¶
Overview ¶
Package pathlink resolves a filesystem path to its true location, following every kind of link the host supports.
It exists because filepath.EvalSymlinks is not enough on Windows, and two separate confinement checks in this codebase were relying on it: the module artifact boundary and the agent's own workspace boundary. Both could be walked through with a junction. Two copies of a security decision is how one of them gets fixed and the other does not, so there is now one.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Resolve ¶
Resolve returns the true location of path.
A Windows junction (mklink /J) is invisible to filepath.EvalSymlinks: asked about the junction itself it returns the junction's own path unchanged, and asked about a file THROUGH one it fails with ErrNotExist -- on a path os.Stat opens happily. A junction needs no privilege to create, unlike a symlink, so it is the easiest boundary to cross and the one that was not checked.
A path that does not exist resolves to itself with no error: naming a file about to be written is legitimate, and the caller's lexical check governs it.
Types ¶
This section is empty.
Source Files