(parentDir, target, dirPath string)
| 852 | } |
| 853 | |
| 854 | func resolveAndValidateRemoteSymlinkBase(parentDir, target, dirPath string) (string, error) { |
| 855 | remoteLog.Printf("Resolving symlink: component=%s target=%s parentDir=%s", dirPath, target, parentDir) |
| 856 | resolvedBase := pathpkg.Clean(target) |
| 857 | if parentDir != "" { |
| 858 | resolvedBase = pathpkg.Clean(pathpkg.Join(parentDir, target)) |
| 859 | } |
| 860 | remoteLog.Printf("Resolved base after path.Clean: %s", resolvedBase) |
| 861 | if resolvedBase == "" || resolvedBase == "." || pathpkg.IsAbs(resolvedBase) || strings.HasPrefix(resolvedBase, "..") { |
| 862 | remoteLog.Printf("Rejecting resolved base %q (escapes repository root)", resolvedBase) |
| 863 | return "", fmt.Errorf("symlink target %q at %s resolves outside repository root: %s", target, dirPath, resolvedBase) |
| 864 | } |
| 865 | return resolvedBase, nil |
| 866 | } |
| 867 | |
| 868 | // DownloadFileFromGitHub downloads a file from a GitHub repository using the GitHub API. |
| 869 | // This is the exported wrapper for downloadFileFromGitHub. |
no test coverage detected