Validate that a resolved credential value is safe for use in a URL path segment. Operates on the raw (decoded) credential value before percent-encoding. Rejects values that could enable path traversal, request splitting, or URI structure breakage.
(value: &str)
| 660 | /// Rejects values that could enable path traversal, request splitting, or |
| 661 | /// URI structure breakage. |
| 662 | fn validate_credential_for_path(value: &str) -> Result<(), String> { |
| 663 | if value.contains("../") || value.contains("..\\") || value == ".." { |
| 664 | return Err("credential contains path traversal sequence".into()); |
| 665 | } |
| 666 | if value.contains('\0') || value.contains('\r') || value.contains('\n') { |
| 667 | return Err("credential contains control character".into()); |
| 668 | } |
| 669 | if value.contains('/') || value.contains('\\') { |
| 670 | return Err("credential contains path separator".into()); |
| 671 | } |
| 672 | if value.contains('?') || value.contains('#') { |
| 673 | return Err("credential contains URI delimiter".into()); |
| 674 | } |
| 675 | Ok(()) |
| 676 | } |
| 677 | |
| 678 | // --------------------------------------------------------------------------- |
| 679 | // URI rewriting |
no outgoing calls
no test coverage detected