Function checkURLPathTraversal

github/github.go:868–880

checkURLPathTraversal returns ErrPathForbidden if urlStr contains ".." as a path segment (e.g. "a/../b"), preventing path traversal attacks. It does not match ".." embedded within a segment (e.g. "file..txt"). The check is performed only on the path portion of the URL, ignoring any query string or f

(urlStr string)

// performed only on the path portion of the URL, ignoring any query string or
// fragment.
func checkURLPathTraversal(urlStr string) error {
	if !strings.Contains(urlStr, "..") {
		return nil
	}
	u, err := url.Parse(urlStr)
	if err != nil {
		return err
	}
	if slices.Contains(strings.Split(u.Path, "/"), "..") {
		return ErrPathForbidden
	}
	return nil
}

// NewUploadRequest creates an upload request. A relative URL can be provided in
// urlStr, in which case it is resolved relative to the UploadURL of the Client.