lockbox

commit 83203a5674587eb01db78f793fb03ab11eb3023c
parent bbe79460cc0b6bfa4a2293bf672cbf2928672664
Author: Sean Enck <sean@ttypty.com>
Date:   Mon, 10 Oct 2022 19:59:32 -0400

filter out some bad paths

Diffstat:
M
internal/backend/actions.go
 | 
9
+++++++++
M
internal/backend/actions_test.go
 | 
9
+++++++++

2 files changed, 18 insertions(+), 0 deletions(-)
diff --git a/internal/backend/actions.go b/internal/backend/actions.go
@@ -153,6 +153,15 @@ func splitComponents(path string) ([]string, string, error) {
 	if len(strings.Split(path, pathSep)) < 2 {
 		return nil, "", errPath
 	}
+	if strings.HasPrefix(path, pathSep) {
+		return nil, "", errors.New("path can NOT be rooted")
+	}
+	if strings.HasSuffix(path, pathSep) {
+		return nil, "", errors.New("path can NOT end with separator")
+	}
+	if strings.Contains(path, pathSep+pathSep) {
+		return nil, "", errors.New("unwilling to operate on path with empty segment")
+	}
 	title := base(path)
 	parts := strings.Split(directory(path), pathSep)
 	return parts, title, nil
diff --git a/internal/backend/actions_test.go b/internal/backend/actions_test.go
@@ -85,6 +85,15 @@ func TestInserts(t *testing.T) {
 	if err := setup(t).Insert("tests", "test"); err.Error() != "input paths must contain at LEAST 2 components" {
 		t.Errorf("wrong error: %v", err)
 	}
+	if err := setup(t).Insert("tests//l", "test"); err.Error() != "unwilling to operate on path with empty segment" {
+		t.Errorf("wrong error: %v", err)
+	}
+	if err := setup(t).Insert("tests/", "test"); err.Error() != "path can NOT end with separator" {
+		t.Errorf("wrong error: %v", err)
+	}
+	if err := setup(t).Insert("/tests", "test"); err.Error() != "path can NOT be rooted" {
+		t.Errorf("wrong error: %v", err)
+	}
 	if err := setup(t).Insert("test", "test"); err.Error() != "input paths must contain at LEAST 2 components" {
 		t.Errorf("wrong error: %v", err)
 	}