admin
b0dd13154b
S1: corrupt settings.json recovers from .bak / safe-defaults+preserve, no crash-loop. F2: validStackName gates restore + export handlers (reject /,\,..,NUL traversal). S3: corrupt quiesce marker logged + quarantined, not silently dropped. Tests T-S1/F2/S3 + red-proofs. Agent/hub untouched. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
20 lines
571 B
Go
20 lines
571 B
Go
package web
|
|
|
|
import (
|
|
"path/filepath"
|
|
"strings"
|
|
)
|
|
|
|
// validStackName reports whether name is a safe stack identifier: a single path segment, never a path.
|
|
// Rejects traversal/escape (`..`, `/`, `\`, NUL) so a stack_name can never be turned into a filesystem
|
|
// path that escapes the stacks/userdata tree. (Storage `where=` is validated separately by gateWhere.)
|
|
func validStackName(name string) bool {
|
|
if name == "" || name == "." || name == ".." {
|
|
return false
|
|
}
|
|
if strings.ContainsAny(name, "/\\\x00") {
|
|
return false
|
|
}
|
|
return name == filepath.Clean(name)
|
|
}
|