sneak
5620b83609
check / check (push) Failing after 0s
Untrusted .mf files were parsed with no path validation, so an entry like ../../etc/passwd flowed into filepath.Join against the checker's base path. ValidatePath ran only on the write side (Builder). Enforce it on every entry in deserializeInner, so all consumers — Checker now, any restore/extract path later — are protected. Reject the whole manifest on the first offender rather than dropping entries, which could hide files from a check; failures wrap a new errInvalidManifestPath sentinel and name the path. A path that is not valid UTF-8 is refused at load time by the proto3 string decoder before validation runs; the test covers that plus the traversal, absolute, backslash, and empty cases, and a valid round-trip. Model: opus-4-8