(workspaceRoot, requested string)
| 219 | } |
| 220 | |
| 221 | func (s Service) workspacePath(workspaceRoot, requested string) (string, error) { |
| 222 | trimmed := strings.TrimPrefix(requested, "/workspace") |
| 223 | trimmed = strings.TrimPrefix(trimmed, "/") |
| 224 | hostPath := filepath.Join(workspaceRoot, trimmed) |
| 225 | cleanRoot := filepath.Clean(workspaceRoot) |
| 226 | cleanPath := filepath.Clean(hostPath) |
| 227 | if cleanPath != cleanRoot && !strings.HasPrefix(cleanPath, cleanRoot+string(os.PathSeparator)) { |
| 228 | return "", fmt.Errorf("path escapes workspace: %s", requested) |
| 229 | } |
| 230 | return cleanPath, nil |
| 231 | } |
| 232 | |
| 233 | func (s Service) recordEvent(event security.Event, payload map[string]any) (security.DecisionRecord, error) { |
| 234 | payload["recorded_at"] = time.Now().UTC().Format(time.RFC3339Nano) |
no outgoing calls
no test coverage detected