diff options
Diffstat (limited to 'internal/admin/api_helpers.go')
| -rw-r--r-- | internal/admin/api_helpers.go | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/internal/admin/api_helpers.go b/internal/admin/api_helpers.go index 3224598..11ad958 100644 --- a/internal/admin/api_helpers.go +++ b/internal/admin/api_helpers.go @@ -4,10 +4,25 @@ import ( "bytes" "fmt" "os" + "strings" "gopkg.in/yaml.v3" ) +// validEntityID reports whether an entity ID can be safely joined into a +// file path under its data directory. IDs come from URL path segments and +// JSON bodies, so an unchecked join could otherwise escape the data +// directory ("../") or touch dot files. +func validEntityID(id string) bool { + if id == "" || id == "." || id == ".." { + return false + } + if strings.ContainsAny(id, `/\`) || strings.ContainsRune(id, 0) { + return false + } + return true +} + func yamlToMap(data []byte) (map[string]any, error) { var v any if err := yaml.Unmarshal(data, &v); err != nil { |