Eyevinn / mp4ff / 37917238974

83%

Build Type

push

github

Committed by tobbee

Commit Message

feat(mp4): open LocalFileResolver files through os.Root

LocalFileResolver checked locations lexically with filepath.IsLocal, so a symbolic link below its directory could lead to any file. It now opens the directory as an os.Root, available since Go 1.24, and the files through it, which also rejects links that lead outside, relative or absolute. Links that stay inside are still followed. The lexical check stays for a clear error on locations such as ../x.

The root is opened on the first resolve, so NewLocalFileResolver still returns no error, and Close closes it together with the files; a resolve after Close opens it again.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Coverage Stats

9 of 11 new or added lines in 1 file covered. (81.82%)

68 existing lines in 4 files now uncovered.

24022 of 29006 relevant lines covered (82.82%)

0.83 hits per line