| 289 | } |
| 290 | |
| 291 | bool cbm_validate_project_name(const char *name) { |
| 292 | if (!name || !*name) |
| 293 | return false; |
| 294 | /* Reject directory traversal */ |
| 295 | if (strcmp(name, "..") == 0 || strstr(name, "..") != NULL) |
| 296 | return false; |
| 297 | /* Reject path separators */ |
| 298 | if (strchr(name, '/') || strchr(name, '\\')) |
| 299 | return false; |
| 300 | /* Reject leading dot (hidden files / relative refs) */ |
| 301 | if (name[0] == '.') |
| 302 | return false; |
| 303 | /* Allow only alphanumeric, dash, underscore, dot */ |
| 304 | for (const char *p = name; *p; p++) { |
| 305 | if (!(((*p >= 'a') && (*p <= 'z')) || ((*p >= 'A') && (*p <= 'Z')) || |
| 306 | ((*p >= '0') && (*p <= '9')) || *p == '-' || *p == '_' || *p == '.')) { |
| 307 | return false; |
| 308 | } |
| 309 | } |
| 310 | return true; |
| 311 | } |
| 312 | |
| 313 | int cbm_json_escape(char *buf, int bufsize, const char *src) { |
| 314 | if (!buf || bufsize <= 0) { |
no outgoing calls
no test coverage detected