isValidCacheID reports whether id is a safe cache identifier. Allowed pattern: ^[A-Za-z0-9_-]{1,64}$ (1-64 characters). This prevents path-traversal attacks (e.g. "../../etc") when the ID is appended to cacheMemoryDirPrefix to form a filesystem path.
(id string)
| 60 | // This prevents path-traversal attacks (e.g. "../../etc") when the ID is |
| 61 | // appended to cacheMemoryDirPrefix to form a filesystem path. |
| 62 | func isValidCacheID(id string) bool { |
| 63 | if id == "" || len(id) > 64 { |
| 64 | return false |
| 65 | } |
| 66 | for _, c := range id { |
| 67 | isLower := c >= 'a' && c <= 'z' |
| 68 | isUpper := c >= 'A' && c <= 'Z' |
| 69 | isDigit := c >= '0' && c <= '9' |
| 70 | isAllowed := c == '_' || c == '-' |
| 71 | if !isLower && !isUpper && !isDigit && !isAllowed { |
| 72 | return false |
| 73 | } |
| 74 | } |
| 75 | return true |
| 76 | } |
| 77 | |
| 78 | // isValidFileExtension reports whether s is a valid file extension of the form ^\.[A-Za-z0-9]+$ |
| 79 | // (e.g. ".json", ".md"). This strict pattern prevents YAML injection when extensions are |
no outgoing calls