mirror of
https://github.com/moby/buildkit.git
synced 2026-08-06 07:40:49 +00:00
7cf63df2a7
Move safeFileName from source/http to source/util/pathutil and apply it to the containerblob source as well. Harden containerblob/pull.go to use os.OpenRoot for file writes, preventing path traversal via crafted filenames. Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com> (cherry picked from commit 3d6e587655d72c343f6fdc7268480a900ba45b0c)
22 lines
378 B
Go
22 lines
378 B
Go
package pathutil
|
|
|
|
import (
|
|
"path/filepath"
|
|
"strings"
|
|
"unicode"
|
|
)
|
|
|
|
func SafeFileName(s string) string {
|
|
defaultName := "download"
|
|
name := filepath.Base(filepath.FromSlash(strings.TrimSpace(s)))
|
|
if name == "" || name == "." || name == ".." {
|
|
return defaultName
|
|
}
|
|
for _, r := range name {
|
|
if r == 0 || unicode.IsControl(r) {
|
|
return defaultName
|
|
}
|
|
}
|
|
return name
|
|
}
|