Function ensureInsideDir

internal/aiagentconfig/builder.go:190–201

ensureInsideDir verifies that filePath is inside dir. Both paths must be already resolved (no symlinks). Returns an error if the file escapes.

(filePath, dir string)

// ensureInsideDir verifies that filePath is inside dir. Both paths must be
// already resolved (no symlinks). Returns an error if the file escapes.
func ensureInsideDir(filePath, dir string) error {
	rel, err := filepath.Rel(dir, filePath)
	if err != nil {
		return fmt.Errorf("path escapes root directory via symlink")
	}

	if rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
		return fmt.Errorf("path escapes root directory via symlink")
	}

	return nil
}