Package: github.com/pancsta/d2/lib/localfile

package localfile Import Path github.com/pancsta/d2/lib/localfile (on go.dev) Dependency Relation imports 8 packages, and imported by one package

Involved Source Files d localfile.go Package localfile provides explicit policies for opening regular local files. The zero value denies access. Callers must deliberately choose either a symlink-safe filesystem root or unrestricted host-filesystem access. On Unix, files are opened nonblocking and verified from the opened descriptor before Open returns, preventing ordinary FIFO open waits. Device-specific open behavior can still vary. Other platforms have no portable nonblocking open flag, so a hostile special file may block before it can be rejected. In addition, os.Root cannot provide a symlink security boundary on GOOS=js and does not retain directory identity across renames on GOOS=js or GOOS=plan9. Callers on those platforms must not treat Rooted as a complete boundary for hostile filesystems. open_unix.go

Package-Level Type Names (only one)

/* sort by: alphabet | popularity */

type Policy (struct) Policy controls access to local files. Its zero value denies all local-file access and is safe for untrusted input. Policy implements the part of fs.FS needed by D2's compiler imports. Open intentionally rejects directories and other non-regular files, so Policy is not a general-purpose directory-browsing filesystem. Methods (total 4) ( Policy) CacheKey(name string) (string, error) CacheKey returns a policy-scoped, canonical key for name. It rejects names outside the policy's lexical scope; Open additionally enforces the rooted symbolic-link boundary. The key prevents a cache filled under an unrestricted policy from bypassing a rooted or denied policy. ( Policy) Close() error Close releases the retained OS root handle. Copies of a rooted Policy share one copy-safe close operation and return the same close result. It does not erase or revoke immutable resources that callers already retained in their own caches. Closing a denied or unrestricted policy is a no-op. ( Policy) Open(name string) (fs.File, error) Open opens a regular file according to the policy. For rooted policies, relative names are interpreted relative to the configured root. Absolute names are accepted only when they are lexically beneath that root, and the retained os.Root enforces the same boundary while following symbolic links. ( Policy) RootPath() (string, bool) RootPath returns the absolute configured root and true for a rooted policy. It returns an empty string and false for denied and unrestricted policies. Implements (at least 3) Policy : github.com/prometheus/common/expfmt.Closer Policy : io.Closer Policy : io/fs.FS As Outputs Of (at least 2) func Rooted(root string) (Policy, error) func Unrestricted() Policy

Package-Level Functions (total 2)

func Rooted(root string) (Policy, error) Rooted returns a policy that permits files at or beneath root. Opens use one retained os.Root, so symbolic links cannot escape root and replacing the configured path cannot retarget the policy on supported platforms.

func Unrestricted() Policy Unrestricted returns a policy that permits arbitrary host-filesystem reads. Use it only for trusted local input, such as the D2 command-line interface.

Package-Level Variables (only one)

var ErrDenied error ErrDenied reports that a policy does not permit a local-file path.