Module redaction 

Shared path and I/O-error redaction algorithms for FFI-facing error messages.

exarch-python and exarch-node both render ArchiveError into host-language exceptions and must decide, per error variant, how much path information to expose. Getting this wrong in either direction is a problem: leaking a host filesystem path can disclose internal directory structure to a user reading a release-build error message (see #453), while over-redacting an archive-relative path that the attacker already authored (e.g. a PathTraversal entry) destroys the defender’s ability to identify which archive entry triggered the violation without actually hiding anything (see #462).

This module owns the two redaction algorithms — sanitize_path_for_error for genuinely host-derived paths and format_entry_path_for_error for archive-relative, attacker-authored paths — plus sanitize_io_error_for_error for I/O error messages (see #463, #464). Both bindings call these algorithms directly, per variant, in their own convert_error; ArchiveError::to_ffi_message uses them via ArchiveError::redacted_path. The mapping from variant to algorithm is therefore still applied independently in three places — here (via redacted_path), in exarch-python::convert_error, and in exarch-node::convert_error — only the two algorithms themselves are single-sourced.

Functions

format_entry_path_for_error

Formats an archive-relative, attacker-authored path for inclusion in an FFI error message.

sanitize_io_error_for_error

Sanitizes I/O error messages for FFI error reporting.

sanitize_path_for_error

Formats a host-derived filesystem path for inclusion in an FFI error message.