Function resolveCachePath

pkg/teamloader/cache.go:51–61

resolveCachePath returns path unchanged when it is empty (in-memory cache) or absolute; otherwise it joins it with parentDir, cleans the result, and refuses any path that escapes parentDir via "..". Note: This is a lexical check only and does not resolve symlinks. An attacker with write access to p

(path, parentDir string)

//     significant privileges
//  3. The cache only stores agent responses, not sensitive data
func resolveCachePath(path, parentDir string) (string, error) {
	if path == "" || filepath.IsAbs(path) {
		return path, nil
	}
	resolved := filepath.Clean(filepath.Join(parentDir, path))
	cleanParent := filepath.Clean(parentDir) + string(filepath.Separator)
	if !strings.HasPrefix(resolved+string(filepath.Separator), cleanParent) {
		return "", fmt.Errorf("cache path %q escapes parent directory", path)
	}
	return resolved, nil
}