mirror of
https://github.com/cheat/cheat.git
synced 2026-03-07 11:13:33 +01:00
cc85a4bdb1
Bug fixes: - Fix inverted pager detection logic (returned error instead of path) - Fix repo.Clone ignoring destination directory parameter - Fix sheet loading using append on pre-sized slices - Clean up partial files on copy failure - Trim whitespace from editor config Security: - Add path traversal protection for cheatsheet names Performance: - Move regex compilation outside search loop - Replace string concatenation with strings.Join in search Build: - Remove go:generate; embed config and usage as string literals - Parallelize release builds - Add fuzz testing infrastructure Testing: - Improve test coverage from 38.9% to 50.2% - Add fuzz tests for search, filter, tags, and validation Documentation: - Fix inaccurate code examples in HACKING.md - Add missing --conf and --all options to man page - Add ADRs for path traversal, env parsing, and search parallelization - Update CONTRIBUTING.md to reflect project policy Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
41 lines
1.1 KiB
Go
41 lines
1.1 KiB
Go
package cheatpath
|
|
|
|
import (
|
|
"fmt"
|
|
"path/filepath"
|
|
"strings"
|
|
)
|
|
|
|
// ValidateSheetName ensures that a cheatsheet name does not contain
|
|
// directory traversal sequences or other potentially dangerous patterns.
|
|
func ValidateSheetName(name string) error {
|
|
// Reject empty names
|
|
if name == "" {
|
|
return fmt.Errorf("cheatsheet name cannot be empty")
|
|
}
|
|
|
|
// Reject names containing directory traversal
|
|
if strings.Contains(name, "..") {
|
|
return fmt.Errorf("cheatsheet name cannot contain '..'")
|
|
}
|
|
|
|
// Reject absolute paths
|
|
if filepath.IsAbs(name) {
|
|
return fmt.Errorf("cheatsheet name cannot be an absolute path")
|
|
}
|
|
|
|
// Reject names that start with ~ (home directory expansion)
|
|
if strings.HasPrefix(name, "~") {
|
|
return fmt.Errorf("cheatsheet name cannot start with '~'")
|
|
}
|
|
|
|
// Reject hidden files (files that start with a dot)
|
|
// We don't display hidden files, so we shouldn't create them
|
|
filename := filepath.Base(name)
|
|
if strings.HasPrefix(filename, ".") {
|
|
return fmt.Errorf("cheatsheet name cannot start with '.' (hidden files are not supported)")
|
|
}
|
|
|
|
return nil
|
|
}
|