mirror of
https://gh-proxy.org/https://github.com/klinsmaya/multica.git
synced 2026-11-11 02:46:45 +08:00
Soda
2a1f393ad2
Use one slash-delimited path contract for skill authoring endpoints and daemon bundle validation. Cover canonical path handling and all public file-write routes with regression tests.
25 lines
720 B
Go
25 lines
720 B
Go
package skill
|
|
|
|
import (
|
|
"path"
|
|
"strings"
|
|
)
|
|
|
|
// IsSafeFilePath reports whether filePath is a canonical, slash-delimited
|
|
// supporting-file path accepted consistently by the server and daemon.
|
|
func IsSafeFilePath(filePath string) bool {
|
|
if filePath == "" || strings.Contains(filePath, "\x00") || strings.HasPrefix(filePath, "/") || strings.Contains(filePath, "\\") {
|
|
return false
|
|
}
|
|
if len(filePath) >= 2 && filePath[1] == ':' && isASCIILetter(filePath[0]) {
|
|
return false
|
|
}
|
|
|
|
clean := path.Clean(filePath)
|
|
return clean != "." && clean == filePath && clean != ".." && !strings.HasPrefix(clean, "../")
|
|
}
|
|
|
|
func isASCIILetter(value byte) bool {
|
|
return value >= 'a' && value <= 'z' || value >= 'A' && value <= 'Z'
|
|
}
|