GCC Code Coverage Report

Directory: Os/
File: FilePathUtils.cpp
Date: 2026-09-03 21:15:10
Exec Total Coverage
Lines: 96 104 92.3%
Functions: 7 7 100.0%
Branches: 83 110 75.5%
Line Branch Exec Source
1 // ======================================================================
2 // \title Os/FilePathUtils.cpp
3 // \brief Implementation of file path utilities
4 // ======================================================================
5 #include <Fw/Types/Assert.hpp>
6 #include <Fw/Types/StringUtils.hpp>
7 #include <Os/FilePathUtils.hpp>
8 #include <Os/FileSystem.hpp>
9 #include <cstring>
10
11 namespace Os {
12 namespace FilePathUtils {
13
14 // Helper: validate that string_length did not return the buffer size
15 // (which indicates no null terminator was found — an invalid string).
16 83 static bool isValidCString(FwSizeType measuredLen, FwSizeType bufferLen) {
17 83 return measuredLen < bufferLen;
18 }
19
20 // Helper: copy the raw (unresolved) absolute path into resolvedOut.
21 // If path is relative, it is prepended with baseDir.
22 28 static Status buildAbsolutePath(const char* path, const char* baseDir, char* resolvedOut, FwSizeType resolvedSize) {
23 28 FW_ASSERT(path != nullptr);
24 28 FW_ASSERT(resolvedOut != nullptr);
25
26
2/2
✓ Branch 1 taken 4 times.
✓ Branch 2 taken 24 times.
 28 if (path[0] != '/') {
27 // Relative path: baseDir is required and must start with '/'
28
2/2
✓ Branch 0 taken 1 times.
✓ Branch 1 taken 3 times.
 4 if (baseDir == nullptr) {
29 1 return INVALID_PATH;
30 }
31 3 const FwSizeType baseDirLen = Fw::StringUtils::string_length(baseDir, MAX_PATH_LENGTH);
32
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 3 times.
 3 if (!isValidCString(baseDirLen, MAX_PATH_LENGTH)) {
33 ✗ return INVALID_PATH;
34 }
35
2/4
✓ Branch 0 taken 3 times.
✗ Branch 1 not taken.
✗ Branch 3 not taken.
✓ Branch 4 taken 3 times.
 3 if (baseDirLen == 0 || baseDir[0] != '/') {
36 ✗ return INVALID_PATH;
37 }
38 3 const FwSizeType pathLen = Fw::StringUtils::string_length(path, MAX_PATH_LENGTH);
39
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 3 times.
 3 if (!isValidCString(pathLen, MAX_PATH_LENGTH)) {
40 ✗ return INVALID_PATH;
41 }
42
2/2
✓ Branch 2 taken 1 times.
✓ Branch 3 taken 2 times.
 3 const FwSizeType needsSlash = (baseDir[baseDirLen - 1] != '/') ? 1 : 0;
43
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 3 times.
 3 if ((baseDirLen + needsSlash + pathLen + 1) > resolvedSize) {
44 ✗ return TOO_LONG;
45 }
46
2/4
✗ Branch 0 not taken.
✓ Branch 1 taken 3 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 3 times.
 3 (void)std::memcpy(resolvedOut, baseDir, baseDirLen);
47 3 FwSizeType pos = baseDirLen;
48
2/2
✓ Branch 0 taken 1 times.
✓ Branch 1 taken 2 times.
 3 if (needsSlash) {
49 1 resolvedOut[pos++] = '/';
50 }
51
2/4
✗ Branch 1 not taken.
✓ Branch 2 taken 3 times.
✗ Branch 3 not taken.
✓ Branch 4 taken 3 times.
 3 (void)std::memcpy(&resolvedOut[pos], path, pathLen);
52 3 pos += pathLen;
53 3 resolvedOut[pos] = '\0';
54 } else {
55 24 const FwSizeType pathLen = Fw::StringUtils::string_length(path, MAX_PATH_LENGTH);
56
2/2
✓ Branch 1 taken 1 times.
✓ Branch 2 taken 23 times.
 24 if (!isValidCString(pathLen, MAX_PATH_LENGTH)) {
57 1 return INVALID_PATH;
58 }
59
2/2
✓ Branch 0 taken 1 times.
✓ Branch 1 taken 22 times.
 23 if (pathLen + 1 > resolvedSize) {
60 1 return TOO_LONG;
61 }
62
2/4
✗ Branch 0 not taken.
✓ Branch 1 taken 22 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 22 times.
 22 (void)std::memcpy(resolvedOut, path, pathLen + 1);
63 }
64 25 return VALID;
65 }
66
67 // Helper: resolve `.`, `..`, and `//` in place within resolvedOut.
68 //
69 // Algorithm: single-pass using read (readPos) and write (writePos) pointers
70 // on the same buffer. Since resolving only shrinks or maintains length,
71 // writePos <= readPos always holds, making memmove safe for overlapping regions.
72 //
73 // For each path segment between '/' separators:
74 // - Empty or `.` segments are skipped (no-op)
75 // - `..` segments back up writePos to the previous '/'
76 // - Normal segments are shifted left (via memmove) to writePos
77 25 static Status resolveInPlace(char* resolvedOut) {
78 25 FW_ASSERT(resolvedOut != nullptr);
79 25 FW_ASSERT(resolvedOut[0] == '/');
80
81 25 const FwSizeType pathLength = Fw::StringUtils::string_length(resolvedOut, MAX_PATH_LENGTH);
82
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 25 times.
 25 if (!isValidCString(pathLength, MAX_PATH_LENGTH)) {
83 ✗ return INVALID_PATH;
84 }
85
86 25 FwSizeType writePos = 1; // position past root '/'
87
88
2/2
✓ Branch 0 taken 94 times.
✓ Branch 1 taken 25 times.
 119 for (FwSizeType readPos = 1; readPos <= pathLength;) {
89 // Mark start of current segment
90 94 FwSizeType segStart = readPos;
91
92 // Scan forward to find the end of this segment (next '/' or end of string)
93
4/4
✓ Branch 0 taken 573 times.
✓ Branch 1 taken 25 times.
✓ Branch 4 taken 504 times.
✓ Branch 5 taken 69 times.
 598 for (; readPos < pathLength && resolvedOut[readPos] != '/'; readPos++) {
94 }
95 94 FwSizeType segLen = readPos - segStart;
96
97 // Advance readPos past the '/' separator (or force exit at end)
98
2/2
✓ Branch 0 taken 69 times.
✓ Branch 1 taken 25 times.
 94 if (readPos < pathLength) {
99 69 readPos++;
100 } else {
101 25 readPos = pathLength + 1;
102 }
103
104 // Skip empty segments (caused by consecutive slashes like "//")
105
2/2
✓ Branch 0 taken 12 times.
✓ Branch 1 taken 82 times.
 94 if (segLen == 0) {
106 12 continue;
107 }
108 // Skip `.` segments (current directory, no-op)
109
3/4
✓ Branch 0 taken 3 times.
✓ Branch 1 taken 79 times.
✓ Branch 4 taken 3 times.
✗ Branch 5 not taken.
 82 if (segLen == 1 && resolvedOut[segStart] == '.') {
110 3 continue;
111 }
112 // Handle `..` segments by backing up to the previous directory
113
5/6
✓ Branch 0 taken 9 times.
✓ Branch 1 taken 70 times.
✓ Branch 4 taken 8 times.
✓ Branch 5 taken 1 times.
✓ Branch 8 taken 8 times.
✗ Branch 9 not taken.
 79 if (segLen == 2 && resolvedOut[segStart] == '.' && resolvedOut[segStart + 1] == '.') {
114
2/2
✓ Branch 0 taken 5 times.
✓ Branch 1 taken 3 times.
 8 if (writePos > 1) {
115 5 writePos--;
116
4/4
✓ Branch 0 taken 37 times.
✓ Branch 1 taken 1 times.
✓ Branch 4 taken 33 times.
✓ Branch 5 taken 4 times.
 38 for (; writePos > 1 && resolvedOut[writePos - 1] != '/'; writePos--) {
117 }
118 }
119 8 continue;
120 }
121
122 // Normal segment: shift left to writePos
123
2/4
✗ Branch 2 not taken.
✓ Branch 3 taken 71 times.
✗ Branch 4 not taken.
✓ Branch 5 taken 71 times.
 71 (void)std::memmove(&resolvedOut[writePos], &resolvedOut[segStart], segLen);
124 71 writePos += segLen;
125 71 resolvedOut[writePos++] = '/';
126 }
127
128 // Remove trailing '/' (unless path is root "/")
129
2/2
✓ Branch 0 taken 24 times.
✓ Branch 1 taken 1 times.
 25 if (writePos > 1) {
130 24 writePos--;
131 }
132 25 resolvedOut[writePos] = '\0';
133 25 return VALID;
134 }
135
136 31 Status resolvePath(const char* path, const char* baseDir, char* resolvedOut, FwSizeType resolvedSize) {
137 31 FW_ASSERT(resolvedOut != nullptr);
138
4/4
✓ Branch 0 taken 30 times.
✓ Branch 1 taken 1 times.
✓ Branch 3 taken 2 times.
✓ Branch 4 taken 28 times.
 31 if (path == nullptr || path[0] == '\0') {
139 3 return INVALID_PATH;
140 }
141
142 28 const Status buildStatus = buildAbsolutePath(path, baseDir, resolvedOut, resolvedSize);
143
2/2
✓ Branch 0 taken 3 times.
✓ Branch 1 taken 25 times.
 28 if (buildStatus != VALID) {
144 3 return buildStatus;
145 }
146 25 return resolveInPlace(resolvedOut);
147 }
148
149 1 Status resolvePath(const Fw::ConstStringBase& path, const Fw::ConstStringBase& baseDir, Fw::StringBase& resolvedOut) {
150 // SAFETY: write directly into resolvedOut's internal buffer to avoid a temporary copy.
151 // StringBase::toChar() returns a pointer to the internal buffer, and resolvePath always
152 // null-terminates the output, keeping the StringBase in a valid state.
153 1 char* outBuffer = const_cast<char*>(resolvedOut.toChar());
154 // Cap at MAX_PATH_LENGTH so resolveInPlace's string_length scan stays consistent
155 1 const FwSizeType capacity = static_cast<FwSizeType>(resolvedOut.getCapacity());
156
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 1 times.
 1 const FwSizeType resolvedSize = (capacity > MAX_PATH_LENGTH) ? MAX_PATH_LENGTH : capacity;
157 1 return resolvePath(path.toChar(), baseDir.toChar(), outBuffer, resolvedSize);
158 }
159
160 17 Status resolveFromCwd(const char* path, char* resolvedOut, FwSizeType resolvedSize) {
161 17 FW_ASSERT(path != nullptr);
162 17 FW_ASSERT(resolvedOut != nullptr);
163
164
2/2
✓ Branch 1 taken 2 times.
✓ Branch 2 taken 15 times.
 17 if (path[0] != '/') {
165 2 char cwdBuffer[MAX_PATH_LENGTH];
166
1/1
✓ Branch 1 taken 2 times.
 2 const Os::FileSystem::Status cwdStatus = Os::FileSystem::getWorkingDirectory(cwdBuffer, MAX_PATH_LENGTH);
167
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 2 times.
 2 if (cwdStatus != Os::FileSystem::Status::OP_OK) {
168 ✗ return INVALID_PATH;
169 }
170
1/1
✓ Branch 1 taken 2 times.
 2 return resolvePath(path, cwdBuffer, resolvedOut, resolvedSize);
171 }
172 15 return resolvePath(path, "/", resolvedOut, resolvedSize);
173 }
174
175 // Internal containment check on already-resolved paths.
176 // Verifies that resolvedPath starts with allowedDirectory as a prefix,
177 // and that the match occurs at a `/` boundary.
178 14 Status checkContainment(const char* resolvedPath, const char* allowedDirectory) {
179 14 FW_ASSERT(resolvedPath != nullptr);
180 14 FW_ASSERT(allowedDirectory != nullptr);
181
182 14 const FwSizeType allowedLen = Fw::StringUtils::string_length(allowedDirectory, MAX_PATH_LENGTH);
183 14 const FwSizeType pathLen = Fw::StringUtils::string_length(resolvedPath, MAX_PATH_LENGTH);
184
185
3/6
✓ Branch 1 taken 14 times.
✗ Branch 2 not taken.
✗ Branch 4 not taken.
✓ Branch 5 taken 14 times.
✗ Branch 6 not taken.
✓ Branch 7 taken 14 times.
 14 if (!isValidCString(allowedLen, MAX_PATH_LENGTH) || !isValidCString(pathLen, MAX_PATH_LENGTH)) {
186 ✗ return INVALID_PATH;
187 }
188
4/4
✓ Branch 0 taken 13 times.
✓ Branch 1 taken 1 times.
✓ Branch 2 taken 1 times.
✓ Branch 3 taken 12 times.
 14 if (allowedLen == 0 || pathLen == 0) {
189 2 return OUTSIDE_SANDBOX;
190 }
191
1/2
✗ Branch 2 not taken.
✓ Branch 3 taken 12 times.
 12 if (allowedDirectory[allowedLen - 1] != '/') {
192 ✗ return OUTSIDE_SANDBOX;
193 }
194
195 // Special case: path equals the allowed directory without trailing '/'.
196 // e.g. path="/data/uplink" matches allowedDirectory="/data/uplink/"
197 // This is valid because the path IS the sandbox directory itself.
198
5/8
✓ Branch 0 taken 1 times.
✓ Branch 1 taken 11 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 1 times.
✗ Branch 4 not taken.
✓ Branch 5 taken 1 times.
✓ Branch 6 taken 1 times.
✗ Branch 7 not taken.
 12 if (pathLen == allowedLen - 1 && std::memcmp(resolvedPath, allowedDirectory, pathLen) == 0) {
199 1 return VALID;
200 }
201
202 // Normal case: path must be at least as long as allowed and start with it
203
2/2
✓ Branch 0 taken 1 times.
✓ Branch 1 taken 10 times.
 11 if (pathLen < allowedLen) {
204 1 return OUTSIDE_SANDBOX;
205 }
206
4/6
✗ Branch 0 not taken.
✓ Branch 1 taken 10 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 10 times.
✓ Branch 4 taken 3 times.
✓ Branch 5 taken 7 times.
 10 if (std::memcmp(resolvedPath, allowedDirectory, allowedLen) != 0) {
207 3 return OUTSIDE_SANDBOX;
208 }
209 7 return VALID;
210 }
211
212 } // namespace FilePathUtils
213 } // namespace Os
214