harald/sanctum
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases 12 Wiki Activity

fix(vfs): V-08 — disallow tab control character in validate path safety

Browse Source
This commit is contained in:
harald
2026-09-19 09:22:46 +02:00
parent 730393423b
commit 708da24d91
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/vfs.rs
+2 -1
View File
@@ -691,7 +691,7 @@ pub fn validate_path_safety(path: &str) -> Result<(), FsError> {
return Err(FsError::Forbidden); return Err(FsError::Forbidden);
} }
for c in path.chars() { for c in path.chars() {
if (c as u32) < 0x20 && c != '\t' { if (c as u32) < 0x20 {
return Err(FsError::Forbidden); return Err(FsError::Forbidden);
} }
} }
@@ -1398,6 +1398,7 @@ mod tests {
assert!(validate_path_safety("/bad\x01file.txt").is_err()); assert!(validate_path_safety("/bad\x01file.txt").is_err());
assert!(validate_path_safety("/bad\rfile.txt").is_err()); assert!(validate_path_safety("/bad\rfile.txt").is_err());
assert!(validate_path_safety("/bad\nfile.txt").is_err()); assert!(validate_path_safety("/bad\nfile.txt").is_err());
assert!(validate_path_safety("/bad\tfile.txt").is_err());
// 3. Gültiger Pfad // 3. Gültiger Pfad
assert!(validate_path_safety("/normal_file_123.txt").is_ok()); assert!(validate_path_safety("/normal_file_123.txt").is_ok());