Post #1496099
2026-02-16 20:50 UTC
@dascandy There's #systemd's chase()/chaseat() [1] and @cyphar 's #libpathrs [2]. Both are pretty good and cover a lot of edge cases.
[1]: https://github.com/systemd/systemd/blob/main/src/basic/chase.c
[2]: https://github.com/cyphar/libpathrs/?tab=readme-ov-file
Replies (1)
-
@dascandy@infosec.exchange 2026-02-16 21:08
@cyphar @brauner I tried to first canonicalize the path (resolve symlinks, remove ./ and ../) and then check if the resulting path is still a subpath of the target root. I can see a few ways it differs from these two, but I don't know if those are security issues?