safe_relative_path.hpp File Reference

Screening for untrusted relative paths that will be joined beneath a destination directory: archive entry names, manifest member paths, and declared asset paths. More...

#include <filesystem>
#include <iterator>
#include <string>

Go to the source code of this file.

Namespaces
namespace	pulp
namespace	pulp::runtime

Functions
bool	pulp::runtime::is_safe_relative_path (const std::filesystem::path &path)
	True only if path is safe to join beneath a destination directory: a non-empty relative path with no root name (C:, \\server), no root directory (/ or \\endiskip), and no component that is empty, .
bool	pulp::runtime::is_within_directory (const std::filesystem::path &directory, const std::filesystem::path &candidate)
	True if candidate, compared lexically after normalization, is directory itself or lies beneath it.

Detailed Description

Screening for untrusted relative paths that will be joined beneath a destination directory: archive entry names, manifest member paths, and declared asset paths.

std::filesystem::path::is_absolute() is not enough on its own. On Windows /etc/passwd, \rooted and C:foo are all not absolute, yet joining any of them onto a directory replaces that directory's root. The checks here refuse every rooted form on every platform, and additionally refuse \\endiskip and : inside a component everywhere, so a name that would escape on Windows is refused on macOS and Linux too.