Function isLocalFileForUpdate

pkg/cli/imports.go:382–398

isLocalFileForUpdate returns true when importPath resolves to an existing file within localWorkflowDir. The resolved absolute path must stay inside localWorkflowDir to guard against path traversal (e.g. "../../etc/passwd" in import paths). importPath must be a relative path — callers must not pass a

(localWorkflowDir, importPath string)

// to guard against path traversal (e.g. "../../etc/passwd" in import paths).
// importPath must be a relative path — callers must not pass absolute paths here.
func isLocalFileForUpdate(localWorkflowDir, importPath string) bool {
	if localWorkflowDir == "" || importPath == "" {
		return false
	}
	localPath := filepath.Join(localWorkflowDir, importPath)
	absDir, err1 := filepath.Abs(localWorkflowDir)
	absPath, err2 := filepath.Abs(localPath)
	if err1 != nil || err2 != nil {
		return false
	}
	// Reject traversal attempts: the resolved path must be a child of localWorkflowDir
	if !strings.HasPrefix(absPath, absDir+string(filepath.Separator)) {
		return false
	}
	_, statErr := os.Stat(localPath)
	return statErr == nil
}

// isWorkflowSpecFormat reports whether path is a workflowspec-style reference.
// It delegates to parser.IsWorkflowSpec to keep CLI and parser behavior consistent.