Skip to main content

validate_session_id

Function validate_session_id 

Source
fn validate_session_id(id: &str) -> Result<()>
Expand description

Rejects a session id that would let chisel-<id>.json escape the cache directory when concatenated into a path (e.g. ../../etc/cron.d/evil, which yields the literal path component chisel-.., followed by a real .. component once the id itself contains a /). Also rejects : to prevent targeting Windows Alternate Data Streams (ADS).