Validate manifest entry paths on deserialize (closes #61)

Untrusted .mf files were parsed with no path validation, so an entry like ../../etc/passwd reached filepath.Join against the checker's base path and mfer check could stat and read outside it. ValidatePath ran only when building a manifest. It now runs on every entry as the manifest loads, so every consumer is covered. The whole manifest is rejected on the first bad entry instead of dropping it, which could hide files from a check; the error wraps errInvalidManifestPath and names the path. Disclosure: a path that is not valid UTF-8 is refused earlier, by the protobuf string decoder, so that error does not name the path. Model: opus-4-8 (implementation); fable-5-1 (summary)
2026-09-22 00:47:26 +02:00
parent 7de4d6ec1c
commit 0deacfc7ed
4 changed files with 165 additions and 0 deletions
@@ -24,6 +24,8 @@ only thing left of the `chore/align-repo-policies` branch is the list below.

 # Completed Steps

+- 2026-09-21: validate manifest entry paths on deserialize so untrusted `.mf`
+  files cannot make `Checker` stat or read outside `basePath` (#61)
 - 2026-09-21: rewrote `script/test` to the canonical pattern (30s timeout,
  `-race -cover`, quiet-first with verbose-on-failure rerun) and fixed the
  process-global logger data race it surfaced (#67)