safeReadFile resolves symlinks, verifies the resolved path stays inside rootDir, and reads the file content. Returns the content and the resolved real path.
(path, rootDir string)
| 157 | // safeReadFile resolves symlinks, verifies the resolved path stays inside rootDir, |
| 158 | // and reads the file content. Returns the content and the resolved real path. |
| 159 | func safeReadFile(path, rootDir string) ([]byte, string, error) { |
| 160 | realPath, err := filepath.EvalSymlinks(path) |
| 161 | if err != nil { |
| 162 | return nil, "", err |
| 163 | } |
| 164 | |
| 165 | if err := ensureInsideDir(realPath, rootDir); err != nil { |
| 166 | return nil, "", err |
| 167 | } |
| 168 | |
| 169 | content, err := os.ReadFile(realPath) |
| 170 | if err != nil { |
| 171 | return nil, "", err |
| 172 | } |
| 173 | |
| 174 | return content, realPath, nil |
| 175 | } |
| 176 | |
| 177 | // computeCombinedHash sorts individual hashes, concatenates them, and hashes the result. |
| 178 | func computeCombinedHash(hashes []string) string { |
no test coverage detected