Function checked_path

atomic-agent/src/record/scope.rs:14–45

(root: &Path, path: &str)

pub type FileManifest = BTreeMap<String, Option<String>>;

fn checked_path(root: &Path, path: &str) -> Result<std::path::PathBuf, String> {
    if path.is_empty()
        || !Path::new(path)
            .components()
            .all(|c| matches!(c, Component::Normal(_)))
    {
        return Err(format!("invalid scoped file path: {path:?}"));
    }
    let root = root.canonicalize().map_err(|e| e.to_string())?;
    let full = root.join(path);
    let mut parent = full.parent();
    while let Some(p) = parent {
        if p.exists() {
            if !p
                .canonicalize()
                .map_err(|e| e.to_string())?
                .starts_with(&root)
            {
                return Err(format!("scoped path escapes repository: {path}"));
            }
            break;
        }
        parent = p.parent();
    }
    if Path::new(path)
        .components()
        .any(|c| matches!(c, Component::Normal(n) if n == ".atomic" || n == ".git"))
    {
        return Err(format!("repository metadata cannot be scoped: {path}"));
    }
    Ok(full)
}

/// Fingerprint a file without following its final symlink. `None` means deleted.
/// Reject directories and paths outside the working tree.