Reject `src` paths that would escape the package directory.
(agent: &str, src: &str)
| 702 | |
| 703 | /// Reject `src` paths that would escape the package directory. |
| 704 | fn reject_parent_traversal(agent: &str, src: &str) -> AgentResult<()> { |
| 705 | if src.split('/').any(|c| c == "..") || src.starts_with('/') { |
| 706 | return Err(AgentError::Integration { |
| 707 | agent: agent.to_string(), |
| 708 | reason: format!("invalid file src '{src}': must be a relative path inside the package"), |
| 709 | }); |
| 710 | } |
| 711 | Ok(()) |
| 712 | } |
| 713 | |
| 714 | #[cfg(test)] |
| 715 | mod tests { |