pub fn safe_join(dest: &Path, entry_name: &str) -> Result<PathBuf>Expand description
Joins entry_name onto dest, refusing anything that escapes.
Resolved COMPONENT-WISE and without touching the filesystem, so the decision cannot depend on what happens to exist — and so it is exhaustively unit-testable with no archive and no temp directory. There is deliberately no code path that returns a sanitised path for a hostile name: the README’s contract is “refused, not silently sanitised”, and a caller that received a cleaned-up path would have no way to know it had been handed one.
. and ./ name the destination directory itself and are ACCEPTED,
returning dest unchanged: tar cf x.tar . — the single most common way
a tarball gets produced — emits ./ as its first entry, and refusing it
would reject the majority of real-world tarballs at exit 7. Naming the
destination cannot escape it, and escaping is the only thing this
function exists to prevent. This is different from a name like a/..,
which also nets to the destination but only after actually consuming a
real component — see the pushed_a_component note below for why the two
are told apart rather than collapsed onto one “ends up empty” check.