Function ValidatePaths

tools/bash/validation.go:317–356

(command string, workspaceRoot string)

}

func ValidatePaths(command string, workspaceRoot string) (bool, []string) {
	paths := ExtractPaths(command)
	invalid := []string{}

	root, err := resolvePath(workspaceRoot)
	if err != nil {
		return false, paths
	}

	for _, p := range paths {
		if strings.HasPrefix(p, "/dev/") || strings.HasPrefix(p, "/proc/") || strings.HasPrefix(p, "/sys/") {
			continue
		}

		if isSpecialSafePath(p) {
			continue
		}

		if IsPathWithinWorkspace(p, root) {
			continue
		}

		full := p
		if !filepath.IsAbs(p) {
			full = filepath.Join(root, p)
		}
		resolvedFull, err := resolvePath(full)
		if err != nil {
			invalid = append(invalid, p)
			continue
		}

		rel, err := filepath.Rel(root, resolvedFull)
		if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
			invalid = append(invalid, p)
		}
	}

	return len(invalid) == 0, invalid
}

func isSpecialSafePath(p string) bool {
	switch p {