Struct PathValidator 

pub struct PathValidator;

Validates paths against security threats

Implementations

impl PathValidator

pub fn contains_null_bytes(path: &str) -> bool

Layer 1: Check for null bytes

pub fn contains_path_traversal(path: &str) -> bool

Layer 2: Check for path traversal components (../)

pub fn contains_url_encoded_traversal(path: &str) -> bool

Layer 3: Check for URL-encoded traversal

pub fn starts_with_tilde(path: &str) -> bool

Layer 4: Check for tilde expansion (~user)

pub fn is_absolute(path: &str) -> bool

Layer 5: Check if path is absolute

pub fn matches_forbidden_prefix( path: &str, forbidden: &[String], ) -> Option<String>

Layer 6: Check against forbidden path prefixes

pub fn normalize_path(path: &str) -> String

Normalize a path for comparison

pub fn is_within_allowed_roots( resolved: &Path, allowed_roots: &[PathBuf], ) -> bool

Check if a resolved path is within allowed roots

pub async fn validate_no_symlink_escape( path: &Path, workspace: &Path, ) -> Result<(), String>

Validate that a path doesn’t escape the workspace via symlinks

pub fn get_extension(path: &str) -> Option<String>

Get the file extension from a path

pub fn is_extension_forbidden(ext: &str, forbidden: &[String]) -> bool

Check if an extension is in the forbidden list

pub fn sanitize_component(component: &str) -> String

Sanitize a path component for safe use