Function AssertSecurePath

internal/binding/audit.go:32–65

AssertSecurePath verifies that a file/command path is safe for use with OpenClaw SecretRef resolution. On success it returns the effective path (the symlink target, if the input was a symlink and allowed). The check is a short, ordered pipeline — each step below is both a read of the contract and a

(params AuditParams)

// The check is a short, ordered pipeline — each step below is both a read of
// the contract and a pointer to the helper that enforces it.
func AssertSecurePath(params AuditParams) (string, error) {
	target := params.TargetPath
	label := params.Label

	if err := requireAbsolutePath(target, label); err != nil {
		return "", err
	}

	linfo, err := lstatNonDir(target, label)
	if err != nil {
		return "", err
	}

	effectivePath, err := resolveSymlinkIfAllowed(target, linfo, params)
	if err != nil {
		return "", err
	}

	if err := requireInTrustedDirs(effectivePath, params.TrustedDirs, label); err != nil {
		return "", err
	}

	if params.AllowInsecurePath {
		return effectivePath, nil
	}

	if err := auditFilePermissions(effectivePath, params.AllowReadableByOthers, label); err != nil {
		return "", err
	}
	if err := checkOwnerUID(effectivePath, label); err != nil {
		return "", err
	}
	return effectivePath, nil
}

// requireAbsolutePath rejects relative paths; relative paths would depend on
// the process cwd and defeat the point of a static audit. Shell-style