24 lines
548 B
Go
24 lines
548 B
Go
package discovery
|
|
|
|
import (
|
|
"path/filepath"
|
|
"strings"
|
|
)
|
|
|
|
// IsInsideRoot reports whether path is the same as, or nested inside,
|
|
// root. Both are cleaned before comparison so trailing slashes, "."
|
|
// segments, and ".." escapes are handled. Prefix tricks like
|
|
// "/foo" vs "/foo-evil" are NOT considered inside.
|
|
func IsInsideRoot(root, path string) bool {
|
|
r := filepath.Clean(root)
|
|
p := filepath.Clean(path)
|
|
if p == r {
|
|
return true
|
|
}
|
|
rel, err := filepath.Rel(r, p)
|
|
if err != nil {
|
|
return false
|
|
}
|
|
return !strings.HasPrefix(rel, "..")
|
|
}
|