Function ValidTreePath

internal/pathutil/tree.go:38–66

ValidTreePath rejects path strings that, if materialised into a worktree, would let an attacker-controlled tree entry escape the worktree or rewrite repository metadata. It rejects: - control characters (< 0x20, 0x7f); - empty paths and "." / ".." components; - Windows volume name prefixes (e.g. C:

(p string)

//
// [1]: https://github.com/git/git/blob/v2.54.0/read-cache.c#L987
func ValidTreePath(p string) error {
	for i := 0; i < len(p); i++ {
		if p[i] < 0x20 || p[i] == 0x7f {
			return fmt.Errorf("%w %q: contains control character", ErrInvalidPath, p)
		}
	}

	parts := strings.FieldsFunc(p, func(r rune) bool { return r == '\\' || r == '/' })
	if len(parts) == 0 {
		return fmt.Errorf("%w: %q", ErrInvalidPath, p)
	}

	// Volume names are not supported, in both formats: \\ and <DRIVE_LETTER>:.
	if vol := filepath.VolumeName(p); vol != "" {
		return fmt.Errorf("%w: %q", ErrInvalidPath, p)
	}

	for _, part := range parts {
		if part == "." || part == ".." {
			return fmt.Errorf("%w %q: cannot use %q", ErrInvalidPath, p, part)
		}

		if IsDotGitName(part) || IsHFSDotGit(part) || IsNTFSDotGit(part) {
			return fmt.Errorf("%w component: %q", ErrInvalidPath, p)
		}
	}

	return nil
}