validateSkillFilePath rejects paths that could escape the skill directory or access hidden files. Only forward-relative, non-hidden paths are allowed.
(p string)
| 236 | // directory or access hidden files. Only forward-relative, |
| 237 | // non-hidden paths are allowed. |
| 238 | func validateSkillFilePath(p string) error { |
| 239 | if p == "" { |
| 240 | return xerrors.New("path is required") |
| 241 | } |
| 242 | if strings.HasPrefix(p, "/") { |
| 243 | return xerrors.New( |
| 244 | "absolute paths are not allowed", |
| 245 | ) |
| 246 | } |
| 247 | for _, component := range strings.Split(p, "/") { |
| 248 | if component == ".." { |
| 249 | return xerrors.New( |
| 250 | "path traversal is not allowed", |
| 251 | ) |
| 252 | } |
| 253 | if strings.HasPrefix(component, ".") { |
| 254 | return xerrors.New( |
| 255 | "hidden file components are not allowed", |
| 256 | ) |
| 257 | } |
| 258 | } |
| 259 | return nil |
| 260 | } |
| 261 | |
| 262 | // DefaultSkillMetaFile is the fallback skill meta file name used |
| 263 | // when loading skill bodies on demand from older agents. |
no test coverage detected