Struct SandboxRoot 

pub struct SandboxRoot { /* private fields */ }

A validated root directory for sandboxed operations.

All paths derived from this root are guaranteed to stay within it. SandboxRoot canonicalizes the root path at construction time and validates all joined paths to prevent directory traversal attacks.

Security Guarantees

• The root path is canonicalized (resolved to absolute, symlinks followed)
• Joined paths cannot escape the root via .. traversal
• Absolute paths are rejected unless they’re within the root
• Symlinks can be optionally rejected to prevent escape via symlink

Example

use xchecker_utils::paths::{SandboxRoot, SandboxConfig};

let root = SandboxRoot::new("/path/to/workspace", SandboxConfig::default())?;
let file = root.join("src/main.rs")?;
println!("Safe path: {}", file.as_path().display());

Implementations

impl SandboxRoot

pub fn new( root: impl AsRef<Path>, config: SandboxConfig, ) -> Result<Self, SandboxError>

Create a new sandbox root from a path.

Canonicalizes the path and verifies it exists as a directory.

Arguments

• root - The path to use as the sandbox root
• config - Configuration for symlink/hardlink handling

Errors

Returns an error if:

• The path does not exist
• The path is not a directory
• The path cannot be canonicalized

pub fn new_default(root: impl AsRef<Path>) -> Result<Self, SandboxError>

Create a sandbox root with default (restrictive) configuration.

This is a convenience method equivalent to SandboxRoot::new(root, SandboxConfig::default()).

pub fn join(&self, rel: impl AsRef<Path>) -> Result<SandboxPath, SandboxError>

Join a relative path, validating it stays within the sandbox.

Arguments

• rel - A relative path to join to the sandbox root

Errors

Returns an error if:

• The path contains .. traversal components
• The path is absolute
• The resolved path escapes the sandbox root
• The path is or contains a symlink (when symlinks are not allowed)
• The path is or contains a hardlink (when hardlinks are not allowed)

pub fn as_path(&self) -> &Path

Get the canonicalized root path.

pub fn config(&self) -> &SandboxConfig

Get the sandbox configuration.

Trait Implementations

impl Clone for SandboxRoot

fn clone(&self) -> SandboxRoot

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SandboxRoot

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.