safe_relative_path.hpp

Go to the documentation of this file.

#pragma once

 
#include <filesystem>
#include <iterator>
#include <string>
 
namespace pulp::runtime {

inline bool is_safe_relative_path(const std::filesystem::path& path) {
    if (path.empty() || path.is_absolute() || path.has_root_name() || path.has_root_directory())
        return false;
    for (const auto& part : path) {
        const std::u8string text = part.u8string();
        if (text.empty() || text == u8"." || text == u8"..")
            return false;
        for (const char8_t c : text)
            if (c == u8'\\' || c == u8':' || c == u8'\0')
                return false;
    }
    return true;
}

inline bool is_within_directory(const std::filesystem::path& directory,
                                const std::filesystem::path& candidate) {
    const auto root = directory.lexically_normal();
    const auto path = candidate.lexically_normal();
    // An empty directory constrains nothing, so it cannot vouch for anything.
    if (root.empty())
        return false;
    // `.` (or `a/..`) is the current directory: any relative candidate that
    // does not climb out of it lies within it.
    if (root == ".") {
        if (path.has_root_name() || path.has_root_directory())
            return false;
        return path.empty() || *path.begin() != "..";
    }
    auto r = root.begin();
    auto p = path.begin();
    for (; r != root.end(); ++r) {
        // A trailing separator on the directory normalizes to an empty final
        // element; it does not constrain the candidate.
        if (r->empty() && std::next(r) == root.end())
            break;
        if (p == path.end() || *p != *r)
            return false;
        ++p;
    }
    return true;
}
 
} // namespace pulp::runtime