Merge branch 'master' into mycomarkup-3-migrate-and-test

hyphae/files.go

@@ -6,7 +6,6 @@ import (
 	"path/filepath"
 
 	"github.com/bouncepaw/mycorrhiza/mimetype"
-	"github.com/bouncepaw/mycorrhiza/util"
 )
 
 // Index finds all hypha files in the full `path` and saves them to the hypha storage.
@@ -20,7 +19,7 @@ func Index(path string) {
 	}(ch)
 
 	for h := range ch {
-		// At this time it is safe to ignore the mutex, because there is only one worker.
+		// It's safe to ignore the mutex because there is a single worker right now.
 		if oh := ByName(h.Name); oh.Exists {
 			oh.MergeIn(h)
 		} else {
@@ -32,7 +31,9 @@ func Index(path string) {
 	log.Println("Indexed", Count(), "hyphae")
 }
 
-// indexHelper finds all hypha files in the full `path` and sends them to the channel. Handling of duplicate entries and attachment and counting them is up to the caller.
+// indexHelper finds all hypha files in the full `path` and sends them to the
+// channel. Handling of duplicate entries and attachment and counting them is
+// up to the caller.
 func indexHelper(path string, nestLevel uint, ch chan *Hypha) {
 	nodes, err := os.ReadDir(path)
 	if err != nil {
@@ -40,10 +41,10 @@ func indexHelper(path string, nestLevel uint, ch chan *Hypha) {
 	}
 
 	for _, node := range nodes {
-		// If this hypha looks like it can be a hypha path, go deeper. Do not touch the .git and static folders for they have an administrative importance!
-		if node.IsDir() &&
-			util.IsCanonicalName(node.Name()) &&
-			node.Name() != ".git" &&
+		// If this hypha looks like it can be a hypha path, go deeper. Do not
+		// touch the .git and static folders for they have an administrative
+		// importance!
+		if node.IsDir() && IsValidName(node.Name()) && node.Name() != ".git" &&
 			!(nestLevel == 0 && node.Name() == "static") {
 			indexHelper(filepath.Join(path, node.Name()), nestLevel+1, ch)
 			continue

hyphae/hyphae.go

@@ -2,16 +2,31 @@
 package hyphae
 
 import (
-	"github.com/bouncepaw/mycorrhiza/files"
 	"log"
 	"path/filepath"
 	"regexp"
+	"strings"
 	"sync"
+
+	"github.com/bouncepaw/mycorrhiza/files"
 )
 
-// HyphaPattern is a pattern which all hyphae must match.
+// HyphaPattern is a pattern which all hyphae names must match.
 var HyphaPattern = regexp.MustCompile(`[^?!:#@><*|"'&%{}]+`)
 
+// IsValidName checks for invalid characters and path traversals.
+func IsValidName(hyphaName string) bool {
+	if !HyphaPattern.MatchString(hyphaName) {
+		return false
+	}
+	for _, segment := range strings.Split(hyphaName, "/") {
+		if segment == ".git" || segment == ".." {
+			return false
+		}
+	}
+	return true
+}
+
 // Hypha keeps vital information about a hypha
 type Hypha struct {
 	sync.RWMutex

hyphae/iterators.go

@@ -79,7 +79,7 @@ func PathographicSort(src chan string) <-chan string {
 
 // Subhyphae returns slice of subhyphae.
 func (h *Hypha) Subhyphae() []*Hypha {
-	hyphae := []*Hypha{}
+	var hyphae []*Hypha
 	for subh := range YieldExistingHyphae() {
 		if strings.HasPrefix(subh.Name, h.Name+"/") {
 			hyphae = append(hyphae, subh)