diff options
| -rw-r--r-- | internal/ctlsock/sanitize.go | 12 | ||||
| -rw-r--r-- | internal/ctlsock/sanitize_test.go | 1 |
2 files changed, 8 insertions, 5 deletions
diff --git a/internal/ctlsock/sanitize.go b/internal/ctlsock/sanitize.go index 22a8a1c..7cf77a5 100644 --- a/internal/ctlsock/sanitize.go +++ b/internal/ctlsock/sanitize.go @@ -6,23 +6,25 @@ import ( ) // SanitizePath adapts filepath.Clean for FUSE paths. -// 1) A leading slash is dropped +// 1) Leading slash(es) are dropped // 2) It returns "" instead of "." // 3) If the cleaned path points above CWD (start with ".."), an empty string // is returned // See the TestSanitizePath testcases for examples. func SanitizePath(path string) string { + // (1) + for len(path) > 0 && path[0] == '/' { + path = path[1:] + } if len(path) == 0 { return "" } - // Drop leading slash - if path[0] == '/' { - path = path[1:] - } clean := filepath.Clean(path) + // (2) if clean == "." { return "" } + // (3) if clean == ".." || strings.HasPrefix(clean, "../") { return "" } diff --git a/internal/ctlsock/sanitize_test.go b/internal/ctlsock/sanitize_test.go index bfdf0a7..d79fa7c 100644 --- a/internal/ctlsock/sanitize_test.go +++ b/internal/ctlsock/sanitize_test.go @@ -19,6 +19,7 @@ func TestSanitizePath(t *testing.T) { {"foo/../..", ""}, {"foo/../../aaaaaa", ""}, {"/foo/../../aaaaaa", ""}, + {"/////", ""}, } for _, tc := range testCases { res := SanitizePath(tc[0]) |