Method __is_safe_host_path

qiling/os/path.py:239–266

Sanitize the specified host path and make sure it does not traverse out of the rootfs directory hierarchy. Args: hostpath : a local path to sanitize strict : whether to raise an error if target path does not exist Returns: whether the path is safe

(self, hostpath: Path, strict: bool = False)

        return self._rootfs_path / vpath

    def __is_safe_host_path(self, hostpath: Path, strict: bool = False) -> bool:
        """Sanitize the specified host path and make sure it does not traverse out
        of the rootfs directory hierarchy.

        Args:
            hostpath : a local path to sanitize
            strict   : whether to raise an error if target path does not exist

        Returns: whether the path is safe to use
        """

        # canonicalization before assertion: resolve any relative path references and
        # symbolic links that may exist.
        #
        # in case strict is set to True and the path does not exist, a FileNotFoundError
        # is raised. this error is left for the user to catch and handle
        hostpath = hostpath.resolve(strict=strict)

        try:
            # to prevent path-traversal issues we have to make sure hostpath ended up
            # as a subpath of rootfs. the following method will fail if that is not
            # the case
            _ = hostpath.relative_to(self._rootfs_path)
        except ValueError:
            return False

        else:
            return True

    def host_to_virtual_path(self, hostpath: str) -> str:
        """Convert a host path to its corresponding virtual path relative to rootfs.