GCC Code Coverage Report

Directory: ./
File: Os/FilePathUtils.cpp
Date: 2026-11-03 22:10:14
Exec Total Coverage
Lines: 90 118 76.3%
Functions: 7 8 87.5%
Branches: 52 94 55.3%
Line Branch Exec Source
1 // ======================================================================
2 // \title Os/FilePathUtils.cpp
3 // \brief Implementation of file path utilities
4 // ======================================================================
5 #include <Fw/Types/Assert.hpp>
6 #include <Fw/Types/StringUtils.hpp>
7 #include <Os/FilePathUtils.hpp>
8 #include <Os/FileSystem.hpp>
9 #include <cstring>
10
11 namespace Os {
12 namespace FilePathUtils {
13
14 // Helper: validate that string_length did not return the buffer size
15 // (which indicates no null terminator was found — an invalid string).
16 82 static bool isValidCString(FwSizeType measuredLen, FwSizeType bufferLen) {
17 82 return measuredLen < bufferLen;
18 }
19
20 // Helper: copy the raw (unresolved) absolute path into resolvedOut.
21 // If path is relative, it is prepended with baseDir.
22 21 static Status buildAbsolutePath(const char* path, const char* baseDir, char* resolvedOut, FwSizeType resolvedSize) {
23 21 FW_ASSERT(path != nullptr);
24 21 FW_ASSERT(resolvedOut != nullptr);
25
26
2/2
✓ Branch 0 taken 16 times.
✓ Branch 1 taken 5 times.
 21 if (path[0] != '/') {
27 // Relative path: baseDir is required and must start with '/'
28
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 16 times.
 16 if (baseDir == nullptr) {
29 ✗ return INVALID_PATH;
30 }
31 16 const FwSizeType baseDirLen = Fw::StringUtils::string_length(baseDir, MAX_PATH_LENGTH);
32
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 16 times.
 16 if (!isValidCString(baseDirLen, MAX_PATH_LENGTH)) {
33 ✗ return INVALID_PATH;
34 }
35
2/4
✓ Branch 0 taken 16 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 16 times.
 16 if (baseDirLen == 0 || baseDir[0] != '/') {
36 ✗ return INVALID_PATH;
37 }
38 16 const FwSizeType pathLen = Fw::StringUtils::string_length(path, MAX_PATH_LENGTH);
39
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 16 times.
 16 if (!isValidCString(pathLen, MAX_PATH_LENGTH)) {
40 ✗ return INVALID_PATH;
41 }
42
1/2
✓ Branch 0 taken 16 times.
✗ Branch 1 not taken.
 16 const FwSizeType needsSlash = (baseDir[baseDirLen - 1] != '/') ? 1 : 0;
43
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 16 times.
 16 if ((baseDirLen + needsSlash + pathLen + 1) > resolvedSize) {
44 ✗ return TOO_LONG;
45 }
46 16 (void)std::memcpy(resolvedOut, baseDir, baseDirLen);
47 16 FwSizeType pos = baseDirLen;
48
1/2
✓ Branch 0 taken 16 times.
✗ Branch 1 not taken.
 16 if (needsSlash) {
49 16 resolvedOut[pos++] = '/';
50 }
51 16 (void)std::memcpy(&resolvedOut[pos], path, pathLen);
52 16 pos += pathLen;
53 16 resolvedOut[pos] = '\0';
54 } else {
55 5 const FwSizeType pathLen = Fw::StringUtils::string_length(path, MAX_PATH_LENGTH);
56
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 5 times.
 5 if (!isValidCString(pathLen, MAX_PATH_LENGTH)) {
57 ✗ return INVALID_PATH;
58 }
59
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 5 times.
 5 if (pathLen + 1 > resolvedSize) {
60 ✗ return TOO_LONG;
61 }
62 5 (void)std::memcpy(resolvedOut, path, pathLen + 1);
63 }
64 21 return VALID;
65 }
66
67 // Helper: resolve `.`, `..`, and `//` in place within resolvedOut.
68 //
69 // Algorithm: single-pass using read (readPos) and write (writePos) pointers
70 // on the same buffer. Since resolving only shrinks or maintains length,
71 // writePos <= readPos always holds, making memmove safe for overlapping regions.
72 //
73 // For each path segment between '/' separators:
74 // - Empty or `.` segments are skipped (no-op)
75 // - `..` segments back up writePos to the previous '/'
76 // - Normal segments are shifted left (via memmove) to writePos
77 21 static Status resolveInPlace(char* resolvedOut) {
78 21 FW_ASSERT(resolvedOut != nullptr);
79 21 FW_ASSERT(resolvedOut[0] == '/');
80
81 21 const FwSizeType pathLength = Fw::StringUtils::string_length(resolvedOut, MAX_PATH_LENGTH);
82
1/2
✗ Branch 1 not taken.
✓ Branch 2 taken 21 times.
 21 if (!isValidCString(pathLength, MAX_PATH_LENGTH)) {
83 ✗ return INVALID_PATH;
84 }
85
86 21 FwSizeType writePos = 1; // position past root '/'
87
88
2/2
✓ Branch 0 taken 131 times.
✓ Branch 1 taken 21 times.
 152 for (FwSizeType readPos = 1; readPos <= pathLength;) {
89 // Mark start of current segment
90 131 FwSizeType segStart = readPos;
91
92 // Scan forward to find the end of this segment (next '/' or end of string)
93
4/4
✓ Branch 0 taken 1192 times.
✓ Branch 1 taken 21 times.
✓ Branch 2 taken 1082 times.
✓ Branch 3 taken 110 times.
 1213 for (; readPos < pathLength && resolvedOut[readPos] != '/'; readPos++) {
94 }
95 131 FwSizeType segLen = readPos - segStart;
96
97 // Advance readPos past the '/' separator (or force exit at end)
98
2/2
✓ Branch 0 taken 110 times.
✓ Branch 1 taken 21 times.
 131 if (readPos < pathLength) {
99 110 readPos++;
100 } else {
101 21 readPos = pathLength + 1;
102 }
103
104 // Skip empty segments (caused by consecutive slashes like "//")
105
2/2
✓ Branch 0 taken 3 times.
✓ Branch 1 taken 128 times.
 131 if (segLen == 0) {
106 3 continue;
107 }
108 // Skip `.` segments (current directory, no-op)
109
3/4
✓ Branch 0 taken 11 times.
✓ Branch 1 taken 117 times.
✓ Branch 2 taken 11 times.
✗ Branch 3 not taken.
 128 if (segLen == 1 && resolvedOut[segStart] == '.') {
110 11 continue;
111 }
112 // Handle `..` segments by backing up to the previous directory
113
1/6
✗ Branch 0 not taken.
✓ Branch 1 taken 117 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
✗ Branch 4 not taken.
✗ Branch 5 not taken.
 117 if (segLen == 2 && resolvedOut[segStart] == '.' && resolvedOut[segStart + 1] == '.') {
114 ✗ if (writePos > 1) {
115 ✗ writePos--;
116 ✗ for (; writePos > 1 && resolvedOut[writePos - 1] != '/'; writePos--) {
117 }
118 }
119 ✗ continue;
120 }
121
122 // Normal segment: shift left to writePos
123 117 (void)std::memmove(&resolvedOut[writePos], &resolvedOut[segStart], segLen);
124 117 writePos += segLen;
125 117 resolvedOut[writePos++] = '/';
126 }
127
128 // Remove trailing '/' (unless path is root "/")
129
2/2
✓ Branch 0 taken 18 times.
✓ Branch 1 taken 3 times.
 21 if (writePos > 1) {
130 18 writePos--;
131 }
132 21 resolvedOut[writePos] = '\0';
133 21 return VALID;
134 }
135
136 21 Status resolvePath(const char* path, const char* baseDir, char* resolvedOut, FwSizeType resolvedSize) {
137 21 FW_ASSERT(resolvedOut != nullptr);
138
2/4
✓ Branch 0 taken 21 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 21 times.
 21 if (path == nullptr || path[0] == '\0') {
139 ✗ return INVALID_PATH;
140 }
141
142 21 const Status buildStatus = buildAbsolutePath(path, baseDir, resolvedOut, resolvedSize);
143
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 21 times.
 21 if (buildStatus != VALID) {
144 ✗ return buildStatus;
145 }
146 21 return resolveInPlace(resolvedOut);
147 }
148
149 ✗ Status resolvePath(const Fw::ConstStringBase& path, const Fw::ConstStringBase& baseDir, Fw::StringBase& resolvedOut) {
150 // SAFETY: write directly into resolvedOut's internal buffer to avoid a temporary copy.
151 // StringBase::toChar() returns a pointer to the internal buffer, and resolvePath always
152 // null-terminates the output, keeping the StringBase in a valid state.
153 ✗ char* outBuffer = const_cast<char*>(resolvedOut.toChar());
154 // Cap at MAX_PATH_LENGTH so resolveInPlace's string_length scan stays consistent
155 ✗ const FwSizeType capacity = static_cast<FwSizeType>(resolvedOut.getCapacity());
156 ✗ const FwSizeType resolvedSize = (capacity > MAX_PATH_LENGTH) ? MAX_PATH_LENGTH : capacity;
157 ✗ return resolvePath(path.toChar(), baseDir.toChar(), outBuffer, resolvedSize);
158 }
159
160 21 Status resolveFromCwd(const char* path, char* resolvedOut, FwSizeType resolvedSize) {
161 21 FW_ASSERT(path != nullptr);
162 21 FW_ASSERT(resolvedOut != nullptr);
163
164
2/2
✓ Branch 0 taken 16 times.
✓ Branch 1 taken 5 times.
 21 if (path[0] != '/') {
165 char cwdBuffer[MAX_PATH_LENGTH];
166
1/1
✓ Branch 1 taken 16 times.
 16 const Os::FileSystem::Status cwdStatus = Os::FileSystem::getWorkingDirectory(cwdBuffer, MAX_PATH_LENGTH);
167
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 16 times.
 16 if (cwdStatus != Os::FileSystem::Status::OP_OK) {
168 ✗ return INVALID_PATH;
169 }
170
1/1
✓ Branch 1 taken 16 times.
 16 return resolvePath(path, cwdBuffer, resolvedOut, resolvedSize);
171 }
172 5 return resolvePath(path, "/", resolvedOut, resolvedSize);
173 }
174
175 8 Status resolveDirectoryFromCwd(const char* path, char* resolvedOut, FwSizeType resolvedSize) {
176 8 FW_ASSERT(path != nullptr);
177 8 FW_ASSERT(resolvedOut != nullptr);
178
179 8 const Status status = resolveFromCwd(path, resolvedOut, resolvedSize);
180
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 8 times.
 8 if (status != VALID) {
181 ✗ return status;
182 }
183 8 const FwSizeType len = Fw::StringUtils::string_length(resolvedOut, resolvedSize);
184
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 8 times.
 8 if (len == 0) {
185 ✗ return INVALID_PATH;
186 }
187
2/2
✓ Branch 0 taken 6 times.
✓ Branch 1 taken 2 times.
 8 if (resolvedOut[len - 1] != '/') {
188 // Need room for the '/' and the terminator
189
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 6 times.
 6 if (len + 2 > resolvedSize) {
190 ✗ return TOO_LONG;
191 }
192 6 resolvedOut[len] = '/';
193 6 resolvedOut[len + 1] = '\0';
194 }
195 8 return VALID;
196 }
197
198 // Internal containment check on already-resolved paths.
199 // Verifies that resolvedPath starts with allowedDirectory as a prefix,
200 // and that the match occurs at a `/` boundary.
201 12 Status checkContainment(const char* resolvedPath, const char* allowedDirectory) {
202 12 FW_ASSERT(resolvedPath != nullptr);
203 12 FW_ASSERT(allowedDirectory != nullptr);
204
205 12 const FwSizeType allowedLen = Fw::StringUtils::string_length(allowedDirectory, MAX_PATH_LENGTH);
206 12 const FwSizeType pathLen = Fw::StringUtils::string_length(resolvedPath, MAX_PATH_LENGTH);
207
208
3/6
✓ Branch 1 taken 12 times.
✗ Branch 2 not taken.
✗ Branch 4 not taken.
✓ Branch 5 taken 12 times.
✗ Branch 6 not taken.
✓ Branch 7 taken 12 times.
 12 if (!isValidCString(allowedLen, MAX_PATH_LENGTH) || !isValidCString(pathLen, MAX_PATH_LENGTH)) {
209 ✗ return INVALID_PATH;
210 }
211
2/4
✓ Branch 0 taken 12 times.
✗ Branch 1 not taken.
✗ Branch 2 not taken.
✓ Branch 3 taken 12 times.
 12 if (allowedLen == 0 || pathLen == 0) {
212 ✗ return OUTSIDE_SANDBOX;
213 }
214
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 12 times.
 12 if (allowedDirectory[allowedLen - 1] != '/') {
215 ✗ return OUTSIDE_SANDBOX;
216 }
217
218 // Special case: path equals the allowed directory without trailing '/'.
219 // e.g. path="/data/uplink" matches allowedDirectory="/data/uplink/"
220 // This is valid because the path IS the sandbox directory itself.
221
1/4
✗ Branch 0 not taken.
✓ Branch 1 taken 12 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
 12 if (pathLen == allowedLen - 1 && std::memcmp(resolvedPath, allowedDirectory, pathLen) == 0) {
222 ✗ return VALID;
223 }
224
225 // Normal case: path must be at least as long as allowed and start with it
226
2/2
✓ Branch 0 taken 2 times.
✓ Branch 1 taken 10 times.
 12 if (pathLen < allowedLen) {
227 2 return OUTSIDE_SANDBOX;
228 }
229
1/2
✗ Branch 0 not taken.
✓ Branch 1 taken 10 times.
 10 if (std::memcmp(resolvedPath, allowedDirectory, allowedLen) != 0) {
230 ✗ return OUTSIDE_SANDBOX;
231 }
232 10 return VALID;
233 }
234
235 } // namespace FilePathUtils
236 } // namespace Os
237