isPathWithinDir checks if a path is within a given directory (prevents path traversal)
(path, dir string)
| 22 | |
| 23 | // isPathWithinDir checks if a path is within a given directory (prevents path traversal) |
| 24 | func isPathWithinDir(path, dir string) bool { |
| 25 | // Get absolute paths |
| 26 | absPath, err := filepath.Abs(path) |
| 27 | if err != nil { |
| 28 | return false |
| 29 | } |
| 30 | absDir, err := filepath.Abs(dir) |
| 31 | if err != nil { |
| 32 | return false |
| 33 | } |
| 34 | |
| 35 | // Get the relative path from dir to path |
| 36 | rel, err := filepath.Rel(absDir, absPath) |
| 37 | if err != nil { |
| 38 | return false |
| 39 | } |
| 40 | |
| 41 | // Check if the relative path tries to go outside the directory |
| 42 | // If it starts with "..", it's trying to escape |
| 43 | return !strings.HasPrefix(rel, ".."+string(filepath.Separator)) && rel != ".." |
| 44 | } |
| 45 | |
| 46 | // findWorkflowFileResult holds the result of finding a workflow file |
| 47 | type findWorkflowFileResult struct { |