SAP / ui5-fs / 41125775326

91%

main: 90%

push

github

[FIX] Contain Link reads within the mapped target subtree

A Link rewrites a requested path by replacing linkPath with targetPath and
forwards the result to the backing reader. The backing reader normalizes the
path, so a request that contains ".." segments can resolve to a resource
outside targetPath. The returned ResourceFacade then exposes that resource
under the link namespace.

Normalize the rewritten POSIX path and confirm it stays within targetPath
before calling the backing reader. Recheck the returned resource's own path
before wrapping it in a ResourceFacade, in both byPath and byGlob, and drop
glob results that resolve outside the subtree.

The trailing slash that _validatePathMapping requires on targetPath keeps the
boundary check segment-aware, so a sibling such as "/resources/application/"
is not accepted for "/resources/app/". createFlatReader builds a Link with a
trailing-slash targetPath, so it inherits the same containment.

425 of 481 branches covered (88.36%)

Branch coverage included in aggregate %.

16 of 16 new or added lines in 1 file covered. (100.0%)

791 of 860 relevant lines covered (91.98%)

52428.09 hits per line