GCC Code Coverage Report

Directory: ./
File: Os/FilePathUtils.cpp
Date: 2026-09-23 22:11:34
Exec Total Coverage
Lines: 78 103 75.7%
Functions: 6 7 85.7%
Branches: 47 86 54.7%
Line Branch Exec Source
1 // ======================================================================
2 // \title Os/FilePathUtils.cpp
3 // \brief Implementation of file path utilities
4 // ======================================================================
5 #include <Fw/Types/Assert.hpp>
6 #include <Fw/Types/StringUtils.hpp>
7 #include <Os/FilePathUtils.hpp>
8 #include <Os/FileSystem.hpp>
9 #include <cstring>
10
11 namespace Os {
12 namespace FilePathUtils {
13
14 // Helper: validate that string_length did not return the buffer size
15 // (which indicates no null terminator was found — an invalid string).
16 57 static bool isValidCString(FwSizeType measuredLen, FwSizeType bufferLen) {
17 57 return measuredLen < bufferLen;
18 }
19
20 // Helper: copy the raw (unresolved) absolute path into resolvedOut.
21 // If path is relative, it is prepended with baseDir.
22 16 static Status buildAbsolutePath(const char* path, const char* baseDir, char* resolvedOut, FwSizeType resolvedSize) {
23 16 FW_ASSERT(path != nullptr);
24 16 FW_ASSERT(resolvedOut != nullptr);
25
26
2/2
✓ Branch 0 taken 11 times.
✓ Branch 1 taken 5 times.
 16 if (path[0] != '/') {
27 // Relative path: baseDir is required and must start with '/'
28
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 11 times.
 11 if (baseDir == nullptr) {
29 ✗ return INVALID_PATH;
30 }
31 11 const FwSizeType baseDirLen = Fw::StringUtils::string_length(baseDir, MAX_PATH_LENGTH);
32
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 11 times.
 11 if (!isValidCString(baseDirLen, MAX_PATH_LENGTH)) {
33 ✗ return INVALID_PATH;
34 }
35
2/4
✓ Branch 0 taken 11 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 11 times.
 11 if (baseDirLen == 0 || baseDir[0] != '/') {
36 ✗ return INVALID_PATH;
37 }
38 11 const FwSizeType pathLen = Fw::StringUtils::string_length(path, MAX_PATH_LENGTH);
39
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 11 times.
 11 if (!isValidCString(pathLen, MAX_PATH_LENGTH)) {
40 ✗ return INVALID_PATH;
41 }
42
1/2
✓ Branch 0 taken 11 times.
✗ Branch 1 not taken.
 11 const FwSizeType needsSlash = (baseDir[baseDirLen - 1] != '/') ? 1 : 0;
43
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 11 times.
 11 if ((baseDirLen + needsSlash + pathLen + 1) > resolvedSize) {
44 ✗ return TOO_LONG;
45 }
46 11 (void)std::memcpy(resolvedOut, baseDir, baseDirLen);
47 11 FwSizeType pos = baseDirLen;
48
1/2
✓ Branch 0 taken 11 times.
✗ Branch 1 not taken.
 11 if (needsSlash) {
49 11 resolvedOut[pos++] = '/';
50 }
51 11 (void)std::memcpy(&resolvedOut[pos], path, pathLen);
52 11 pos += pathLen;
53 11 resolvedOut[pos] = '\0';
54 } else {
55 5 const FwSizeType pathLen = Fw::StringUtils::string_length(path, MAX_PATH_LENGTH);
56
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 5 times.
 5 if (!isValidCString(pathLen, MAX_PATH_LENGTH)) {
57 ✗ return INVALID_PATH;
58 }
59
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 5 times.
 5 if (pathLen + 1 > resolvedSize) {
60 ✗ return TOO_LONG;
61 }
62 5 (void)std::memcpy(resolvedOut, path, pathLen + 1);
63 }
64 16 return VALID;
65 }
66
67 // Helper: resolve `.`, `..`, and `//` in place within resolvedOut.
68 //
69 // Algorithm: single-pass using read (readPos) and write (writePos) pointers
70 // on the same buffer. Since resolving only shrinks or maintains length,
71 // writePos <= readPos always holds, making memmove safe for overlapping regions.
72 //
73 // For each path segment between '/' separators:
74 // - Empty or `.` segments are skipped (no-op)
75 // - `..` segments back up writePos to the previous '/'
76 // - Normal segments are shifted left (via memmove) to writePos
77 16 static Status resolveInPlace(char* resolvedOut) {
78 16 FW_ASSERT(resolvedOut != nullptr);
79 16 FW_ASSERT(resolvedOut[0] == '/');
80
81 16 const FwSizeType pathLength = Fw::StringUtils::string_length(resolvedOut, MAX_PATH_LENGTH);
82
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 16 times.
 16 if (!isValidCString(pathLength, MAX_PATH_LENGTH)) {
83 ✗ return INVALID_PATH;
84 }
85
86 16 FwSizeType writePos = 1; // position past root '/'
87
88
2/2
✓ Branch 0 taken 86 times.
✓ Branch 1 taken 16 times.
 102 for (FwSizeType readPos = 1; readPos <= pathLength;) {
89 // Mark start of current segment
90 86 FwSizeType segStart = readPos;
91
92 // Scan forward to find the end of this segment (next '/' or end of string)
93
4/4
✓ Branch 0 taken 707 times.
✓ Branch 1 taken 16 times.
✓ Branch 2 taken 637 times.
✓ Branch 3 taken 70 times.
 723 for (; readPos < pathLength && resolvedOut[readPos] != '/'; readPos++) {
94 }
95 86 FwSizeType segLen = readPos - segStart;
96
97 // Advance readPos past the '/' separator (or force exit at end)
98
2/2
✓ Branch 0 taken 70 times.
✓ Branch 1 taken 16 times.
 86 if (readPos < pathLength) {
99 70 readPos++;
100 } else {
101 16 readPos = pathLength + 1;
102 }
103
104 // Skip empty segments (caused by consecutive slashes like "//")
105
2/2
✓ Branch 0 taken 3 times.
✓ Branch 1 taken 83 times.
 86 if (segLen == 0) {
106 3 continue;
107 }
108 // Skip `.` segments (current directory, no-op)
109
3/4
✓ Branch 0 taken 6 times.
✓ Branch 1 taken 77 times.
✓ Branch 2 taken 6 times.
✗ Branch 3 not taken.
 83 if (segLen == 1 && resolvedOut[segStart] == '.') {
110 6 continue;
111 }
112 // Handle `..` segments by backing up to the previous directory
113
1/6
✗ Branch 0 not taken.
✓ Branch 1 taken 77 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
✗ Branch 4 not taken.
✗ Branch 5 not taken.
 77 if (segLen == 2 && resolvedOut[segStart] == '.' && resolvedOut[segStart + 1] == '.') {
114 ✗ if (writePos > 1) {
115 ✗ writePos--;
116 ✗ for (; writePos > 1 && resolvedOut[writePos - 1] != '/'; writePos--) {
117 }
118 }
119 ✗ continue;
120 }
121
122 // Normal segment: shift left to writePos
123 77 (void)std::memmove(&resolvedOut[writePos], &resolvedOut[segStart], segLen);
124 77 writePos += segLen;
125 77 resolvedOut[writePos++] = '/';
126 }
127
128 // Remove trailing '/' (unless path is root "/")
129
2/2
✓ Branch 0 taken 13 times.
✓ Branch 1 taken 3 times.
 16 if (writePos > 1) {
130 13 writePos--;
131 }
132 16 resolvedOut[writePos] = '\0';
133 16 return VALID;
134 }
135
136 16 Status resolvePath(const char* path, const char* baseDir, char* resolvedOut, FwSizeType resolvedSize) {
137 16 FW_ASSERT(resolvedOut != nullptr);
138
2/4
✓ Branch 0 taken 16 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 16 times.
 16 if (path == nullptr || path[0] == '\0') {
139 ✗ return INVALID_PATH;
140 }
141
142 16 const Status buildStatus = buildAbsolutePath(path, baseDir, resolvedOut, resolvedSize);
143
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 16 times.
 16 if (buildStatus != VALID) {
144 ✗ return buildStatus;
145 }
146 16 return resolveInPlace(resolvedOut);
147 }
148
149 ✗ Status resolvePath(const Fw::ConstStringBase& path, const Fw::ConstStringBase& baseDir, Fw::StringBase& resolvedOut) {
150 // SAFETY: write directly into resolvedOut's internal buffer to avoid a temporary copy.
151 // StringBase::toChar() returns a pointer to the internal buffer, and resolvePath always
152 // null-terminates the output, keeping the StringBase in a valid state.
153 ✗ char* outBuffer = const_cast<char*>(resolvedOut.toChar());
154 // Cap at MAX_PATH_LENGTH so resolveInPlace's string_length scan stays consistent
155 ✗ const FwSizeType capacity = static_cast<FwSizeType>(resolvedOut.getCapacity());
156 ✗ const FwSizeType resolvedSize = (capacity > MAX_PATH_LENGTH) ? MAX_PATH_LENGTH : capacity;
157 ✗ return resolvePath(path.toChar(), baseDir.toChar(), outBuffer, resolvedSize);
158 }
159
160 16 Status resolveFromCwd(const char* path, char* resolvedOut, FwSizeType resolvedSize) {
161 16 FW_ASSERT(path != nullptr);
162 16 FW_ASSERT(resolvedOut != nullptr);
163
164
2/2
✓ Branch 0 taken 11 times.
✓ Branch 1 taken 5 times.
 16 if (path[0] != '/') {
165 char cwdBuffer[MAX_PATH_LENGTH];
166
1/1
✓ Branch 1 taken 11 times.
 11 const Os::FileSystem::Status cwdStatus = Os::FileSystem::getWorkingDirectory(cwdBuffer, MAX_PATH_LENGTH);
167
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 11 times.
 11 if (cwdStatus != Os::FileSystem::Status::OP_OK) {
168 ✗ return INVALID_PATH;
169 }
170
1/1
✓ Branch 1 taken 11 times.
 11 return resolvePath(path, cwdBuffer, resolvedOut, resolvedSize);
171 }
172 5 return resolvePath(path, "/", resolvedOut, resolvedSize);
173 }
174
175 // Internal containment check on already-resolved paths.
176 // Verifies that resolvedPath starts with allowedDirectory as a prefix,
177 // and that the match occurs at a `/` boundary.
178 7 Status checkContainment(const char* resolvedPath, const char* allowedDirectory) {
179 7 FW_ASSERT(resolvedPath != nullptr);
180 7 FW_ASSERT(allowedDirectory != nullptr);
181
182 7 const FwSizeType allowedLen = Fw::StringUtils::string_length(allowedDirectory, MAX_PATH_LENGTH);
183 7 const FwSizeType pathLen = Fw::StringUtils::string_length(resolvedPath, MAX_PATH_LENGTH);
184
185
3/6
✓ Branch 1 taken 7 times.
✗ Branch 2 not taken.
✗ Branch 4 not taken.
✓ Branch 5 taken 7 times.
✗ Branch 6 not taken.
✓ Branch 7 taken 7 times.
 7 if (!isValidCString(allowedLen, MAX_PATH_LENGTH) || !isValidCString(pathLen, MAX_PATH_LENGTH)) {
186 ✗ return INVALID_PATH;
187 }
188
2/4
✓ Branch 0 taken 7 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 7 times.
 7 if (allowedLen == 0 || pathLen == 0) {
189 ✗ return OUTSIDE_SANDBOX;
190 }
191
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 7 times.
 7 if (allowedDirectory[allowedLen - 1] != '/') {
192 ✗ return OUTSIDE_SANDBOX;
193 }
194
195 // Special case: path equals the allowed directory without trailing '/'.
196 // e.g. path="/data/uplink" matches allowedDirectory="/data/uplink/"
197 // This is valid because the path IS the sandbox directory itself.
198
1/4
✗ Branch 0 not taken.
✓ Branch 1 taken 7 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
 7 if (pathLen == allowedLen - 1 && std::memcmp(resolvedPath, allowedDirectory, pathLen) == 0) {
199 ✗ return VALID;
200 }
201
202 // Normal case: path must be at least as long as allowed and start with it
203
2/2
✓ Branch 0 taken 2 times.
✓ Branch 1 taken 5 times.
 7 if (pathLen < allowedLen) {
204 2 return OUTSIDE_SANDBOX;
205 }
206
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 5 times.
 5 if (std::memcmp(resolvedPath, allowedDirectory, allowedLen) != 0) {
207 ✗ return OUTSIDE_SANDBOX;
208 }
209 5 return VALID;
210 }
211
212 } // namespace FilePathUtils
213 } // namespace Os
214