Implementation of the guarded filesystem directory join. More...

#include "mdl_pathfs.h"
#include <stdint.h>
#include "mdl_sanitize.h"

Include dependency graph for mdl_pathfs.c:

Functions
bool	mdl_join_dir_under (mdl_storage_t storage, const char parent_abs, const char seg, char out, size_t cap)
	Join seg under parent_abs, create it, and verify it stays inside.

Detailed Description

Implementation of the guarded filesystem directory join.

Resolves directory components through injected namespace operations and rejects joins that escape the selected root.

Copyright: Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT

Definition in file mdl_pathfs.c.

Function Documentation

◆ mdl_join_dir_under()

bool mdl_join_dir_under	(	mdl_storage_t *	storage,
		const char *	parent_abs,
		const char *	seg,
		char *	out,
		size_t	cap )

Join seg under parent_abs, create it, and verify it stays inside.

The single guarded directory join every series_dir/chapter_dir path routes through. mdl_path_join refuses a traversal, separator-bearing, or over-long seg before any mkdir, so a scraped .. can never name a directory. The filesystem adapter then confines the path beneath its bound root and refuses symbolic-link traversal. Any stat or create failure returns false without printing; the composition layer owns diagnostics.

Parameters

[in,out]	storage	Initialized portable filesystem binding.
[in]	parent_abs	Canonical portable parent directory.
[in]	seg	Sanitised child segment (a leaf or a slug-derived name).
[out]	out	Buffer receiving the joined directory path.
[in]	cap	Capacity of `out` in bytes.

Returns: Whether out names a directory contained under parent_abs.

Return values

true	The child directory exists beneath `parent_abs`.
false	Invalid input, unsafe/over-long `seg`, missing parent, or a backend stat/create failure.

Precondition: parent_abs is an existing canonical directory below the bound root.; seg and out are non-NULL; seg is NUL-terminated.

Postcondition: On true, out names an existing directory under parent_abs.; On false, no path outside parent_abs is created or used.

Note: Not thread-safe because one storage binding owns shared adapter state.

See also: mdl_path_join The lexical join that rejects the traversal segment.

Since: 0.1.0

Definition at line 15 of file mdl_pathfs.c.

References fw_fs_stat_t::exists, mdl_storage_t::fs, fw_fs_mkdir(), fw_fs_stat(), k_fw_fs_node_directory, k_ra8_err_exists, k_ra8_ok, mdl_path_join(), fw_fs_t::names, and fw_fs_stat_t::type.

Referenced by internal_mdl_fetch_resolve_dest(), mdl_fetch_run(), and priv_mdl_app_prepare_series_dir().

Functions

Detailed Description

Function Documentation

◆ mdl_join_dir_under()