(filePath, baseDir string, cache *ImportCache)
| 56 | } |
| 57 | |
| 58 | func ResolveIncludePath(filePath, baseDir string, cache *ImportCache) (string, error) { |
| 59 | // Handle builtin paths - these are embedded files that bypass filesystem resolution. |
| 60 | if strings.HasPrefix(filePath, BuiltinPathPrefix) { |
| 61 | if !BuiltinVirtualFileExists(filePath) { |
| 62 | return "", fmt.Errorf("builtin file not found: %s", filePath) |
| 63 | } |
| 64 | return filePath, nil |
| 65 | } |
| 66 | |
| 67 | if isWorkflowSpec(filePath) { |
| 68 | return "", fmt.Errorf("remote imports not available in Wasm: %s", filePath) |
| 69 | } |
| 70 | |
| 71 | githubFolder := baseDir |
| 72 | for !strings.HasSuffix(githubFolder, ".github") { |
| 73 | parent := filepath.Dir(githubFolder) |
| 74 | if parent == githubFolder || parent == "." || parent == "/" { |
| 75 | githubFolder = baseDir |
| 76 | break |
| 77 | } |
| 78 | githubFolder = parent |
| 79 | } |
| 80 | |
| 81 | resolveBase := baseDir |
| 82 | securityBase := githubFolder |
| 83 | if strings.HasSuffix(githubFolder, ".github") { |
| 84 | repoRoot := filepath.Dir(githubFolder) |
| 85 | filePathSlash := filepath.ToSlash(filePath) |
| 86 | if strings.HasPrefix(filePathSlash, ".github/") { |
| 87 | resolveBase = repoRoot |
| 88 | } else if stripped, ok := strings.CutPrefix(filePathSlash, "/"); ok { |
| 89 | // Repo-root-absolute path: only .github/ and .agents/ subdirectories are accessible. |
| 90 | if !strings.HasPrefix(stripped, ".github/") && !strings.HasPrefix(stripped, ".agents/") { |
| 91 | return "", fmt.Errorf("security: path %s must be within .github or .agents folder", filePath) |
| 92 | } |
| 93 | filePath = filepath.FromSlash(stripped) |
| 94 | resolveBase = repoRoot |
| 95 | if strings.HasPrefix(stripped, ".agents/") { |
| 96 | securityBase = filepath.Join(repoRoot, ".agents") |
| 97 | } else { |
| 98 | // .github/-prefixed: security scope is the .github folder. |
| 99 | securityBase = githubFolder |
| 100 | } |
| 101 | } |
| 102 | } |
| 103 | |
| 104 | fullPath := filepath.Join(resolveBase, filePath) |
| 105 | |
| 106 | normalizedSecurityBase := filepath.Clean(securityBase) |
| 107 | normalizedFullPath := filepath.Clean(fullPath) |
| 108 | |
| 109 | relativePath, err := filepath.Rel(normalizedSecurityBase, normalizedFullPath) |
| 110 | if err != nil || relativePath == ".." || strings.HasPrefix(relativePath, ".."+string(filepath.Separator)) || filepath.IsAbs(relativePath) { |
| 111 | allowedFolder := filepath.Base(normalizedSecurityBase) |
| 112 | return "", fmt.Errorf("security: path %s must be within %s folder (resolves to: %s)", filePath, allowedFolder, relativePath) |
| 113 | } |
| 114 | |
| 115 | // In wasm builds, check the virtual filesystem first |
nothing calls this directly
no test coverage detected