mirror of
https://github.com/morluto/rea
synced 2026-10-27 22:45:19 -04:00
yi111
3f59a84bd1
Use the equivalent hex NUL spelling in named public contracts while preserving current path and reserved-name validation. Verify converted JSON Schema and real stdio catalog consumers. Closes #1329 Co-authored-by: Yi-111-a <97448247+Yi-111-a@users.noreply.github.com>
26 lines
964 B
TypeScript
26 lines
964 B
TypeScript
import { isAbsolute, relative, sep } from "node:path";
|
|
import { z } from "zod";
|
|
|
|
/**
|
|
* Preserve selected filesystem names while rejecting OS-invalid NUL bytes.
|
|
*
|
|
* The pattern spells NUL as `\x00` rather than `\u0000`. Both accept exactly the
|
|
* same strings. The hex form also avoids the short `\0` spelling rejected by
|
|
* strict schema consumers. A client can reject its entire tool request when
|
|
* one advertised pattern cannot compile. See `offsetDateTimeSchema` for the
|
|
* same hex-escape convention.
|
|
*/
|
|
export const localPathStringSchema = z
|
|
.string()
|
|
.min(1)
|
|
.regex(/^[^\x00]*$/u, "Local filesystem paths cannot contain NUL");
|
|
|
|
/** Test lexical containment on the host platform; callers must resolve symlinks first. */
|
|
export const isPathWithinRoot = (root: string, path: string): boolean => {
|
|
const value = relative(root, path);
|
|
return (
|
|
value === "" ||
|
|
(value !== ".." && !value.startsWith(`..${sep}`) && !isAbsolute(value))
|
|
);
|
|
};
|