Function LoadStrategy

internal/plugins/strategy/strategy.go:185–225

LoadStrategy loads a strategy from the given name. The resolved path is validated to stay within the strategy directory to prevent path traversal.

(filename string)

// LoadStrategy loads a strategy from the given name.
// The resolved path is validated to stay within the strategy directory to prevent path traversal.
func LoadStrategy(filename string) (*Strategy, error) {
	if filename == "" {
		return nil, nil
	}

	// Get the strategy directory path
	strategyDir, err := getStrategyDir()
	if err != nil {
		return nil, err
	}

	// First try with .json extension
	strategyPath := filepath.Join(strategyDir, filename+".json")
	if _, err := os.Stat(strategyPath); os.IsNotExist(err) {
		// Try without extension
		strategyPath = filepath.Join(strategyDir, filename)
		if _, err := os.Stat(strategyPath); os.IsNotExist(err) {
			return nil, fmt.Errorf(i18n.T("strategy_not_found"), filename)
		}
	}

	// Validate the resolved path stays within strategyDir to prevent path traversal
	cleanedPath := filepath.Clean(strategyPath)
	cleanedDir := filepath.Clean(strategyDir) + string(os.PathSeparator)
	if !strings.HasPrefix(cleanedPath, cleanedDir) {
		return nil, fmt.Errorf(i18n.T("strategy_path_traversal"), filename)
	}

	data, err := os.ReadFile(strategyPath)
	if err != nil {
		return nil, err
	}

	var strategy Strategy
	if err := json.Unmarshal(data, &strategy); err != nil {
		return nil, err
	}
	strategy.Name = strings.TrimSuffix(filepath.Base(strategyPath), ".json")

	return &strategy, nil
}

// ListStrategies prints available strategies
func (sm *StrategiesManager) ListStrategies(shellCompleteList bool) error {