GCC Code Coverage Report

Directory: ./
File: Os/FilePathUtils.cpp
Date: 2026-09-03 21:13:48
Exec Total Coverage
Lines: 96 104 92.3%
Functions: 7 7 100.0%
Branches: 83 110 75.5%
Line Branch Exec Source
1 // ======================================================================
2 // \title Os/FilePathUtils.cpp
3 // \brief Implementation of file path utilities
4 // ======================================================================
5 #include <Fw/Types/Assert.hpp>
6 #include <Fw/Types/StringUtils.hpp>
7 #include <Os/FilePathUtils.hpp>
8 #include <Os/FileSystem.hpp>
9 #include <cstring>
10
11 namespace Os {
12 namespace FilePathUtils {
13
14 // Helper: validate that string_length did not return the buffer size
15 // (which indicates no null terminator was found — an invalid string).
16 231 static bool isValidCString(FwSizeType measuredLen, FwSizeType bufferLen) {
17 231 return measuredLen < bufferLen;
18 }
19
20 // Helper: copy the raw (unresolved) absolute path into resolvedOut.
21 // If path is relative, it is prepended with baseDir.
22 72 static Status buildAbsolutePath(const char* path, const char* baseDir, char* resolvedOut, FwSizeType resolvedSize) {
23 72 FW_ASSERT(path != nullptr);
24 72 FW_ASSERT(resolvedOut != nullptr);
25
26
2/2
✓ Branch 1 taken 22 times.
✓ Branch 2 taken 50 times.
 72 if (path[0] != '/') {
27 // Relative path: baseDir is required and must start with '/'
28
2/2
✓ Branch 0 taken 1 times.
✓ Branch 1 taken 21 times.
 22 if (baseDir == nullptr) {
29 1 return INVALID_PATH;
30 }
31 21 const FwSizeType baseDirLen = Fw::StringUtils::string_length(baseDir, MAX_PATH_LENGTH);
32
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 21 times.
 21 if (!isValidCString(baseDirLen, MAX_PATH_LENGTH)) {
33 ✗ return INVALID_PATH;
34 }
35
2/4
✓ Branch 0 taken 21 times.
✗ Branch 1 not taken.
✗ Branch 3 not taken.
✓ Branch 4 taken 21 times.
 21 if (baseDirLen == 0 || baseDir[0] != '/') {
36 ✗ return INVALID_PATH;
37 }
38 21 const FwSizeType pathLen = Fw::StringUtils::string_length(path, MAX_PATH_LENGTH);
39
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 21 times.
 21 if (!isValidCString(pathLen, MAX_PATH_LENGTH)) {
40 ✗ return INVALID_PATH;
41 }
42
2/2
✓ Branch 2 taken 19 times.
✓ Branch 3 taken 2 times.
 21 const FwSizeType needsSlash = (baseDir[baseDirLen - 1] != '/') ? 1 : 0;
43
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 21 times.
 21 if ((baseDirLen + needsSlash + pathLen + 1) > resolvedSize) {
44 ✗ return TOO_LONG;
45 }
46
2/4
✗ Branch 0 not taken.
✓ Branch 1 taken 21 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 21 times.
 21 (void)std::memcpy(resolvedOut, baseDir, baseDirLen);
47 21 FwSizeType pos = baseDirLen;
48
2/2
✓ Branch 0 taken 19 times.
✓ Branch 1 taken 2 times.
 21 if (needsSlash) {
49 19 resolvedOut[pos++] = '/';
50 }
51
2/4
✗ Branch 1 not taken.
✓ Branch 2 taken 21 times.
✗ Branch 3 not taken.
✓ Branch 4 taken 21 times.
 21 (void)std::memcpy(&resolvedOut[pos], path, pathLen);
52 21 pos += pathLen;
53 21 resolvedOut[pos] = '\0';
54 } else {
55 50 const FwSizeType pathLen = Fw::StringUtils::string_length(path, MAX_PATH_LENGTH);
56
2/2
✓ Branch 1 taken 1 times.
✓ Branch 2 taken 49 times.
 50 if (!isValidCString(pathLen, MAX_PATH_LENGTH)) {
57 1 return INVALID_PATH;
58 }
59
2/2
✓ Branch 0 taken 1 times.
✓ Branch 1 taken 48 times.
 49 if (pathLen + 1 > resolvedSize) {
60 1 return TOO_LONG;
61 }
62
2/4
✗ Branch 0 not taken.
✓ Branch 1 taken 48 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 48 times.
 48 (void)std::memcpy(resolvedOut, path, pathLen + 1);
63 }
64 69 return VALID;
65 }
66
67 // Helper: resolve `.`, `..`, and `//` in place within resolvedOut.
68 //
69 // Algorithm: single-pass using read (readPos) and write (writePos) pointers
70 // on the same buffer. Since resolving only shrinks or maintains length,
71 // writePos <= readPos always holds, making memmove safe for overlapping regions.
72 //
73 // For each path segment between '/' separators:
74 // - Empty or `.` segments are skipped (no-op)
75 // - `..` segments back up writePos to the previous '/'
76 // - Normal segments are shifted left (via memmove) to writePos
77 69 static Status resolveInPlace(char* resolvedOut) {
78 69 FW_ASSERT(resolvedOut != nullptr);
79 69 FW_ASSERT(resolvedOut[0] == '/');
80
81 69 const FwSizeType pathLength = Fw::StringUtils::string_length(resolvedOut, MAX_PATH_LENGTH);
82
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 69 times.
 69 if (!isValidCString(pathLength, MAX_PATH_LENGTH)) {
83 ✗ return INVALID_PATH;
84 }
85
86 69 FwSizeType writePos = 1; // position past root '/'
87
88
2/2
✓ Branch 0 taken 418 times.
✓ Branch 1 taken 69 times.
 487 for (FwSizeType readPos = 1; readPos <= pathLength;) {
89 // Mark start of current segment
90 418 FwSizeType segStart = readPos;
91
92 // Scan forward to find the end of this segment (next '/' or end of string)
93
4/4
✓ Branch 0 taken 2637 times.
✓ Branch 1 taken 69 times.
✓ Branch 4 taken 2288 times.
✓ Branch 5 taken 349 times.
 2706 for (; readPos < pathLength && resolvedOut[readPos] != '/'; readPos++) {
94 }
95 418 FwSizeType segLen = readPos - segStart;
96
97 // Advance readPos past the '/' separator (or force exit at end)
98
2/2
✓ Branch 0 taken 349 times.
✓ Branch 1 taken 69 times.
 418 if (readPos < pathLength) {
99 349 readPos++;
100 } else {
101 69 readPos = pathLength + 1;
102 }
103
104 // Skip empty segments (caused by consecutive slashes like "//")
105
2/2
✓ Branch 0 taken 33 times.
✓ Branch 1 taken 385 times.
 418 if (segLen == 0) {
106 33 continue;
107 }
108 // Skip `.` segments (current directory, no-op)
109
3/4
✓ Branch 0 taken 3 times.
✓ Branch 1 taken 382 times.
✓ Branch 4 taken 3 times.
✗ Branch 5 not taken.
 385 if (segLen == 1 && resolvedOut[segStart] == '.') {
110 3 continue;
111 }
112 // Handle `..` segments by backing up to the previous directory
113
5/6
✓ Branch 0 taken 10 times.
✓ Branch 1 taken 372 times.
✓ Branch 4 taken 9 times.
✓ Branch 5 taken 1 times.
✓ Branch 8 taken 9 times.
✗ Branch 9 not taken.
 382 if (segLen == 2 && resolvedOut[segStart] == '.' && resolvedOut[segStart + 1] == '.') {
114
2/2
✓ Branch 0 taken 6 times.
✓ Branch 1 taken 3 times.
 9 if (writePos > 1) {
115 6 writePos--;
116
4/4
✓ Branch 0 taken 40 times.
✓ Branch 1 taken 2 times.
✓ Branch 4 taken 36 times.
✓ Branch 5 taken 4 times.
 42 for (; writePos > 1 && resolvedOut[writePos - 1] != '/'; writePos--) {
117 }
118 }
119 9 continue;
120 }
121
122 // Normal segment: shift left to writePos
123
2/4
✗ Branch 2 not taken.
✓ Branch 3 taken 373 times.
✗ Branch 4 not taken.
✓ Branch 5 taken 373 times.
 373 (void)std::memmove(&resolvedOut[writePos], &resolvedOut[segStart], segLen);
124 373 writePos += segLen;
125 373 resolvedOut[writePos++] = '/';
126 }
127
128 // Remove trailing '/' (unless path is root "/")
129
2/2
✓ Branch 0 taken 68 times.
✓ Branch 1 taken 1 times.
 69 if (writePos > 1) {
130 68 writePos--;
131 }
132 69 resolvedOut[writePos] = '\0';
133 69 return VALID;
134 }
135
136 75 Status resolvePath(const char* path, const char* baseDir, char* resolvedOut, FwSizeType resolvedSize) {
137 75 FW_ASSERT(resolvedOut != nullptr);
138
4/4
✓ Branch 0 taken 74 times.
✓ Branch 1 taken 1 times.
✓ Branch 3 taken 2 times.
✓ Branch 4 taken 72 times.
 75 if (path == nullptr || path[0] == '\0') {
139 3 return INVALID_PATH;
140 }
141
142 72 const Status buildStatus = buildAbsolutePath(path, baseDir, resolvedOut, resolvedSize);
143
2/2
✓ Branch 0 taken 3 times.
✓ Branch 1 taken 69 times.
 72 if (buildStatus != VALID) {
144 3 return buildStatus;
145 }
146 69 return resolveInPlace(resolvedOut);
147 }
148
149 1 Status resolvePath(const Fw::ConstStringBase& path, const Fw::ConstStringBase& baseDir, Fw::StringBase& resolvedOut) {
150 // SAFETY: write directly into resolvedOut's internal buffer to avoid a temporary copy.
151 // StringBase::toChar() returns a pointer to the internal buffer, and resolvePath always
152 // null-terminates the output, keeping the StringBase in a valid state.
153 1 char* outBuffer = const_cast<char*>(resolvedOut.toChar());
154 // Cap at MAX_PATH_LENGTH so resolveInPlace's string_length scan stays consistent
155 1 const FwSizeType capacity = static_cast<FwSizeType>(resolvedOut.getCapacity());
156
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 1 times.
 1 const FwSizeType resolvedSize = (capacity > MAX_PATH_LENGTH) ? MAX_PATH_LENGTH : capacity;
157 1 return resolvePath(path.toChar(), baseDir.toChar(), outBuffer, resolvedSize);
158 }
159
160 61 Status resolveFromCwd(const char* path, char* resolvedOut, FwSizeType resolvedSize) {
161 61 FW_ASSERT(path != nullptr);
162 61 FW_ASSERT(resolvedOut != nullptr);
163
164
2/2
✓ Branch 1 taken 20 times.
✓ Branch 2 taken 41 times.
 61 if (path[0] != '/') {
165 20 char cwdBuffer[MAX_PATH_LENGTH];
166
1/1
✓ Branch 1 taken 20 times.
 20 const Os::FileSystem::Status cwdStatus = Os::FileSystem::getWorkingDirectory(cwdBuffer, MAX_PATH_LENGTH);
167
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 20 times.
 20 if (cwdStatus != Os::FileSystem::Status::OP_OK) {
168 ✗ return INVALID_PATH;
169 }
170
1/1
✓ Branch 1 taken 20 times.
 20 return resolvePath(path, cwdBuffer, resolvedOut, resolvedSize);
171 }
172 41 return resolvePath(path, "/", resolvedOut, resolvedSize);
173 }
174
175 // Internal containment check on already-resolved paths.
176 // Verifies that resolvedPath starts with allowedDirectory as a prefix,
177 // and that the match occurs at a `/` boundary.
178 35 Status checkContainment(const char* resolvedPath, const char* allowedDirectory) {
179 35 FW_ASSERT(resolvedPath != nullptr);
180 35 FW_ASSERT(allowedDirectory != nullptr);
181
182 35 const FwSizeType allowedLen = Fw::StringUtils::string_length(allowedDirectory, MAX_PATH_LENGTH);
183 35 const FwSizeType pathLen = Fw::StringUtils::string_length(resolvedPath, MAX_PATH_LENGTH);
184
185
3/6
✓ Branch 1 taken 35 times.
✗ Branch 2 not taken.
✗ Branch 4 not taken.
✓ Branch 5 taken 35 times.
✗ Branch 6 not taken.
✓ Branch 7 taken 35 times.
 35 if (!isValidCString(allowedLen, MAX_PATH_LENGTH) || !isValidCString(pathLen, MAX_PATH_LENGTH)) {
186 ✗ return INVALID_PATH;
187 }
188
4/4
✓ Branch 0 taken 34 times.
✓ Branch 1 taken 1 times.
✓ Branch 2 taken 1 times.
✓ Branch 3 taken 33 times.
 35 if (allowedLen == 0 || pathLen == 0) {
189 2 return OUTSIDE_SANDBOX;
190 }
191
1/2
✗ Branch 2 not taken.
✓ Branch 3 taken 33 times.
 33 if (allowedDirectory[allowedLen - 1] != '/') {
192 ✗ return OUTSIDE_SANDBOX;
193 }
194
195 // Special case: path equals the allowed directory without trailing '/'.
196 // e.g. path="/data/uplink" matches allowedDirectory="/data/uplink/"
197 // This is valid because the path IS the sandbox directory itself.
198
5/8
✓ Branch 0 taken 1 times.
✓ Branch 1 taken 32 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 1 times.
✗ Branch 4 not taken.
✓ Branch 5 taken 1 times.
✓ Branch 6 taken 1 times.
✗ Branch 7 not taken.
 33 if (pathLen == allowedLen - 1 && std::memcmp(resolvedPath, allowedDirectory, pathLen) == 0) {
199 1 return VALID;
200 }
201
202 // Normal case: path must be at least as long as allowed and start with it
203
2/2
✓ Branch 0 taken 2 times.
✓ Branch 1 taken 30 times.
 32 if (pathLen < allowedLen) {
204 2 return OUTSIDE_SANDBOX;
205 }
206
4/6
✗ Branch 0 not taken.
✓ Branch 1 taken 30 times.
✗ Branch 2 not taken.
✓ Branch 3 taken 30 times.
✓ Branch 4 taken 4 times.
✓ Branch 5 taken 26 times.
 30 if (std::memcmp(resolvedPath, allowedDirectory, allowedLen) != 0) {
207 4 return OUTSIDE_SANDBOX;
208 }
209 26 return VALID;
210 }
211
212 } // namespace FilePathUtils
213 } // namespace Os
214