feat: implement legacy config auth storage and core api

chfs-ng/internal/storage/storage.go

@@ -1,8 +1,11 @@
 package storage
 
 import (
+	"errors"
+	"io/fs"
 	"os"
 	"path/filepath"
+	"strings"
 )
 
 type Storage interface {
@@ -17,24 +20,82 @@ type Storage interface {
 
 type Local struct{ Root string }
 
-func (s Local) real(path string) string               { return filepath.Join(s.Root, filepath.Clean("/"+path)) }
-func (s Local) Stat(path string) (os.FileInfo, error) { return os.Stat(s.real(path)) }
-func (s Local) Open(path string) (*os.File, error)    { return os.Open(s.real(path)) }
+func (s Local) real(path string) (string, error) {
+	root, err := filepath.Abs(s.Root)
+	if err != nil {
+		return "", err
+	}
+	p := strings.TrimPrefix(filepath.Clean("/"+path), string(filepath.Separator))
+	full := filepath.Join(root, p)
+	rel, err := filepath.Rel(root, full)
+	if err != nil {
+		return "", err
+	}
+	if rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
+		return "", errors.New("path escapes storage root")
+	}
+	return full, nil
+}
+func (s Local) Stat(path string) (os.FileInfo, error) {
+	p, e := s.real(path)
+	if e != nil {
+		return nil, e
+	}
+	return os.Stat(p)
+}
+func (s Local) Open(path string) (*os.File, error) {
+	p, e := s.real(path)
+	if e != nil {
+		return nil, e
+	}
+	return os.Open(p)
+}
 func (s Local) Create(path string) (*os.File, error) {
-	p := s.real(path)
-	if err := os.MkdirAll(filepath.Dir(p), 0755); err != nil {
-		return nil, err
+	p, e := s.real(path)
+	if e != nil {
+		return nil, e
+	}
+	if e = os.MkdirAll(filepath.Dir(p), 0755); e != nil {
+		return nil, e
 	}
 	return os.Create(p)
 }
-func (s Local) Remove(path string) error   { return os.RemoveAll(s.real(path)) }
-func (s Local) Rename(a, b string) error   { return os.Rename(s.real(a), s.real(b)) }
-func (s Local) MkdirAll(path string) error { return os.MkdirAll(s.real(path), 0755) }
+func (s Local) Remove(path string) error {
+	p, e := s.real(path)
+	if e != nil {
+		return e
+	}
+	return os.RemoveAll(p)
+}
+func (s Local) Rename(a, b string) error {
+	pa, e := s.real(a)
+	if e != nil {
+		return e
+	}
+	pb, e := s.real(b)
+	if e != nil {
+		return e
+	}
+	return os.Rename(pa, pb)
+}
+func (s Local) MkdirAll(path string) error {
+	p, e := s.real(path)
+	if e != nil {
+		return e
+	}
+	return os.MkdirAll(p, 0755)
+}
 func (s Local) List(path string) ([]os.FileInfo, error) {
-	f, err := os.Open(s.real(path))
-	if err != nil {
-		return nil, err
+	p, e := s.real(path)
+	if e != nil {
+		return nil, e
+	}
+	f, e := os.Open(p)
+	if e != nil {
+		return nil, e
 	}
 	defer f.Close()
 	return f.Readdir(-1)
 }
+
+var _ fs.FS