pub fn validate_path_in_workspace(
path: &Path,
workspace_root: &Path,
) -> Result<PathBuf, PathSecurityError>Expand description
Validates that a path is within the workspace root (or an extra root allowed
via WINX_ALLOW_PATHS). Returns the canonicalized path if valid.
ยงSecurity
- Prevents path traversal attacks (../)
- Detects symlinks pointing outside the allowed roots
- Canonicalizes path before comparison