Function cbm_canonical_path

src/foundation/compat_fs.c:964–1030

Canonicalize an EXISTING path (collapse `..`, resolve links/junctions): * realpath on POSIX; a final path queried from an opened handle on Windows. * The previous Windows callers used the ANSI CRT (_access/_fullpath) on UTF-8 * input — locale-dependent by construction: on a CJK system codepage (e.g. * Big5) the UTF-8 bytes of a CJK path re-decode into different characters and * canonicalizati

 * only lexical and would let an allowed-root check follow a junction outside
 * the root.  Returns 0 when the path does not exist or cannot be resolved. */
int cbm_canonical_path(const char *path, char *out, size_t out_sz) {
    if (!path || !out || out_sz == 0) {
        return 0;
    }
#ifdef _WIN32
    wchar_t *wpath = cbm_path_to_wide(path);
    if (!wpath) {
        return 0;
    }
    HANDLE handle = CreateFileW(wpath, FILE_READ_ATTRIBUTES,
                                FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL,
                                OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, NULL);
    free(wpath);
    if (handle == INVALID_HANDLE_VALUE) {
        return 0;
    }
    DWORD needed =
        GetFinalPathNameByHandleW(handle, NULL, 0, FILE_NAME_NORMALIZED | VOLUME_NAME_DOS);
    /* MAXDWORD keeps the +1 below safe; calloc rejects an unrepresentable
     * capacity * sizeof(wchar_t) allocation on narrower size_t targets. */
    if (needed == 0 || needed == MAXDWORD) {
        (void)CloseHandle(handle);
        return 0;
    }
    size_t capacity = (size_t)needed + 1;
    wchar_t *wfull = calloc(capacity, sizeof(*wfull));
    if (!wfull) {
        (void)CloseHandle(handle);
        return 0;
    }
    DWORD n = GetFinalPathNameByHandleW(handle, wfull, (DWORD)capacity,
                                        FILE_NAME_NORMALIZED | VOLUME_NAME_DOS);
    (void)CloseHandle(handle);
    if (n == 0 || (size_t)n >= capacity) {
        free(wfull);
        return 0;
    }

    /* Preserve the conventional DOS/UNC form returned by the old API while
     * retaining the handle-based resolution. */
    if (wcsncmp(wfull, L"\\\\?\\UNC\\", 8) == 0) {
        size_t tail_length = wcslen(wfull + 8);
        wmemmove(wfull + 2, wfull + 8, tail_length + 1);
        wfull[0] = L'\\';
        wfull[1] = L'\\';
    } else if (wcsncmp(wfull, L"\\\\?\\", 4) == 0) {
        size_t tail_length = wcslen(wfull + 4);
        wmemmove(wfull, wfull + 4, tail_length + 1);
    }
    char *utf8 = cbm_wide_to_utf8(wfull);
    free(wfull);
    if (!utf8) {
        return 0;
    }
    size_t len = strlen(utf8);
    if (len >= out_sz) {
        free(utf8);
        return 0;