Method readFile

pkg/tools/builtin/filesystem/filesystem.go:690–699

readFile is a TOCTOU-safe equivalent of [os.ReadFile] for paths that the allow-list contains. When no rooted access is available it falls back to the plain [os.ReadFile]. Callers MUST pass a path that has already been validated by [resolveAndCheckPath].

(resolved string)

// the plain [os.ReadFile]. Callers MUST pass a path that has already been
// validated by [resolveAndCheckPath].
func (t *ToolSet) readFile(resolved string) ([]byte, error) {
	root, rel, err := t.rootedAccess(resolved)
	if err != nil {
		return nil, err
	}
	if root != nil {
		return root.ReadFile(rel)
	}
	return os.ReadFile(resolved)
}

// writeFile is a TOCTOU-safe equivalent of [os.WriteFile]. See [readFile]
// for the contract. The call is rejected by the kernel when any component