From 274686d10d3386a41f8fb6bc3363269a734afe0e Mon Sep 17 00:00:00 2001 From: Ophestra Date: Wed, 29 Oct 2025 03:40:09 +0900 Subject: internal/validate: relocate from app These are free of the dispatcher from internal/app. This change relocates them into their own package. Signed-off-by: Ophestra --- internal/validate/validate.go | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 internal/validate/validate.go (limited to 'internal/validate/validate.go') diff --git a/internal/validate/validate.go b/internal/validate/validate.go new file mode 100644 index 00000000..a4e82753 --- /dev/null +++ b/internal/validate/validate.go @@ -0,0 +1,20 @@ +// Package validate provides functions for validating string values of various types. +package validate + +import ( + "path/filepath" + "strings" +) + +// DeepContainsH returns whether basepath is equivalent to or is the parent of targpath. +// +// This is used for path hiding warning behaviour, the purpose of which is to improve +// user experience and is *not* a security feature and must not be treated as such. +func DeepContainsH(basepath, targpath string) (bool, error) { + const upper = ".." + string(filepath.Separator) + + rel, err := filepath.Rel(basepath, targpath) + return err == nil && + rel != ".." && + !strings.HasPrefix(rel, upper), err +} -- cgit v1.3.1