Struct FsRoot 

pub struct FsRoot { /* private fields */ }

A directory the API may touch, and nothing outside it.

Held by value in the app state; every filesystem path in the API is produced by one of these methods and by no other route.

Implementations

impl FsRoot

pub fn new(root: impl AsRef<Path>) -> Result<Self>

Anchor a jail at root, which must already exist.

Canonicalised once here so every later comparison is against a path with symlinks already resolved — otherwise a symlinked root would make every containment check compare unlike things.

pub fn path(&self) -> &Path

The jail’s own path.

pub fn resolve_existing(&self, rel: &str) -> Result<PathBuf, FsError>

Resolve a path that must already exist.

Containment is decided by canonicalising the deepest part of the path that exists, never by the kind of error a full canonicalisation returned. Branching on the error kind is what leaks: a path whose parent is a file fails with ENOTDIR while a path whose parent is absent fails with NotFound, so answering differently tells the caller which files exist outside the jail. It also mishandles a symlink that points out of the root — the link resolves, the target does not exist, and a lexical check sees a path that never left.

Walking down instead means every real directory on the way is resolved through its symlinks and checked, and the verdict never depends on an errno. resolve_for_create uses the same discipline.

pub fn resolve_for_create(&self, rel: &str) -> Result<PathBuf, FsError>

Resolve a path that does not exist yet (an upload target).

The target itself cannot be canonicalised, so the nearest existing ancestor is canonicalised instead and the remaining segments are checked lexically. Those segments may not contain ..: with nothing on disk to resolve against, a traversal there would go unnoticed until the write.

pub fn relative(&self, abs: &Path) -> Option<String>

Render an absolute path inside the jail as a root-relative POSIX string.

Returns None for anything outside, so a caller cannot accidentally publish a path it should not have.

Trait Implementations

impl Clone for FsRoot

fn clone(&self) -> FsRoot

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for FsRoot

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.