Method isPathAllowed

app/src/API/PathPolicy.cpp:96–134

* @brief Validate a file path against the API allowlist, if configured. */

 * @brief Validate a file path against the API allowlist, if configured.
 */
bool API::isPathAllowed(const QString& filePath, const bool allowNonexistent)
{
  QStringList roots;
  if (qEnvironmentVariableIsSet("SERIAL_STUDIO_API_ALLOWED_PATHS")) {
    const QString envValue = QString::fromLocal8Bit(qgetenv("SERIAL_STUDIO_API_ALLOWED_PATHS"));
    if (envValue.trimmed().isEmpty())
      return false;

    roots = envValue.split(QDir::listSeparator(), Qt::SkipEmptyParts);
  }

  else
    roots = {QDir::homePath(), QDir::tempPath()};

  const QString targetPath = normalizedPath(filePath, allowNonexistent);
  if (targetPath.isEmpty())
    return false;

  for (const auto& root : std::as_const(roots)) {
    const QString rootPath = normalizedPath(root.trimmed(), true);
    if (rootPath.isEmpty())
      continue;

#ifdef Q_OS_WIN
    const Qt::CaseSensitivity sensitivity = Qt::CaseInsensitive;
#else
    const Qt::CaseSensitivity sensitivity = Qt::CaseSensitive;
#endif

    if (targetPath.compare(rootPath, sensitivity) == 0)
      return true;

    const QString prefix = rootPath + QLatin1Char('/');
    if (targetPath.startsWith(prefix, sensitivity))
      return true;
  }

  return false;
}