Method resolveAndCheckPath

pkg/tools/builtin/filesystem/filesystem.go:635–655

resolveAndCheckPath is the canonical entry point used by every filesystem handler that operates on a user-supplied path. It resolves the path against the working directory and validates the result against the allow- and deny-lists. The returned string is the on-disk path the handler should pass to t

(path string)

//   - On GOOS=windows, [*os.Root] additionally rejects reserved device
//     names (NUL, COM1, …), which is a strengthening, not a weakening.
func (t *ToolSet) resolveAndCheckPath(path string) (string, error) {
	if t.sandboxBroken {
		return "", errors.New("filesystem toolset is disabled due to invalid allow/deny list configuration")
	}

	resolved := t.resolvePath(path)
	if t.allowList == nil && t.denyList == nil {
		return resolved, nil
	}
	realPath, err := resolveRealPath(resolved)
	if err != nil {
		return "", fmt.Errorf("resolving %q: %w", path, err)
	}
	if t.denyList != nil && t.denyList.contains(realPath) {
		return "", fmt.Errorf("path %q is inside a denied directory (%s)", path, t.denyList.describe())
	}
	if t.allowList != nil && !t.allowList.contains(realPath) {
		return "", fmt.Errorf("path %q is outside the allowed directories (%s)", path, t.allowList.describe())
	}
	return resolved, nil
}

// rootedAccess returns the [*os.Root] handle and rooted (slash-separated)
// name for resolved when the allow-list is configured.