Function critpatch_cache_path_

src/Backends/SVDSBTL/SVDSBTLBackend.cpp:268–285

Critpatch sidecar path: lives next to the .svd.bin.z files so directory-level cache cleanup catches both. The opthash binds the patch to the same options blob the surfaces were built against. Defense-in-depth against path traversal: rejects any fluid_name / source_backend containing '/', '\\', or "..". Mirrors the validation in SVDSurfaceSerializer::default_cache_path; without it a caller passi

// since `default_cache_dir()` derives the parent dir from
// `getenv("HOME")` (CodeQL tracks this as taint on fopen).
std::filesystem::path critpatch_cache_path_(const std::string& fluid_name, const std::string& source_backend, const std::string& options_canonical) {
    const auto unsafe = [](const std::string& s) {
        return s.empty() || s.find('/') != std::string::npos || s.find('\\') != std::string::npos || s.find("..") != std::string::npos;
    };
    if (unsafe(fluid_name)) {
        throw std::invalid_argument("SVDSBTLBackend: invalid fluid_name (must be a bare component name)");
    }
    if (unsafe(source_backend)) {
        throw std::invalid_argument("SVDSBTLBackend: invalid source_backend");
    }
    const std::filesystem::path dir = CoolProp::sbtl::SVDSurfaceSerializer::default_cache_dir();
    const std::uint64_t opthash = opthash_fnv1a_(options_canonical);
    // Match the SVDSurface filename pattern <Fluid>.<Source>.<...>.<opthash>.svd.bin.z
    // but with .critpatch.bin suffix (no zlib — too small to matter).
    std::ostringstream oss;
    oss << fluid_name << '.' << source_backend << ".critpatch." << std::hex << opthash << ".bin";
    return dir / oss.str();
}

}  // namespace