Reject `src` paths that would escape the package directory.
(agent: &str, src: &str)
| 307 | |
| 308 | /// Reject `src` paths that would escape the package directory. |
| 309 | fn reject_parent_traversal(agent: &str, src: &str) -> AgentResult<()> { |
| 310 | if src.split('/').any(|c| c == "..") || src.starts_with('/') { |
| 311 | return Err(AgentError::Integration { |
| 312 | agent: agent.to_string(), |
| 313 | reason: format!("invalid file src '{src}': must be a relative path inside the package"), |
| 314 | }); |
| 315 | } |
| 316 | Ok(()) |
| 317 | } |
| 318 | |
| 319 | #[cfg(test)] |
| 320 | mod tests { |