Skip to content

Commit

Permalink
chore: use methods in stdlib instead
Browse files Browse the repository at this point in the history
Signed-off-by: xliao <[email protected]>
  • Loading branch information
suzaku committed Aug 15, 2023
1 parent 94b986d commit 6823b1e
Showing 1 changed file with 2 additions and 10 deletions.
12 changes: 2 additions & 10 deletions util/security/path_traversal.go
Original file line number Diff line number Diff line change
Expand Up @@ -10,11 +10,11 @@ import (
// `requestedPath` must be absolute paths. They may contain any number of `./` or `/../` dir changes.
func EnforceToCurrentRoot(currentRoot, requestedPath string) (string, error) {
currentRoot = filepath.Clean(currentRoot)
requestedDir, requestedFile := parsePath(requestedPath)
requestedDir, requestedFile := filepath.Split(filepath.Clean(requestedPath))
if !isRequestedDirUnderCurrentRoot(currentRoot, requestedDir) {
return "", fmt.Errorf("requested path %s should be on or under current directory %s", requestedPath, currentRoot)
}
return requestedDir + string(filepath.Separator) + requestedFile, nil
return filepath.Join(requestedDir, requestedFile), nil
}

func isRequestedDirUnderCurrentRoot(currentRoot, requestedPath string) bool {
Expand All @@ -31,11 +31,3 @@ func isRequestedDirUnderCurrentRoot(currentRoot, requestedPath string) bool {
}
return strings.HasPrefix(requestedPath, currentRoot)
}

func parsePath(path string) (string, string) {
directory := filepath.Dir(path)
if directory == path {
return directory, ""
}
return directory, filepath.Base(path)
}

0 comments on commit 6823b1e

Please sign in to comment.