Module path_confinement 

Shared infrastructure for confining templated sink outputs to an operator-authored boundary.

Sinks that render templates into security-relevant identifiers (paths, keys, URIs, …) use the helpers in this module to ensure the rendered value cannot escape the literal portion the operator wrote.

Structs

PathConfinement

Confines a rendered filesystem path to a base directory derived from a template’s literal prefix.

Enums

BuildError

Errors raised while building a PathConfinement from a template.

ConfineError

Errors raised while confining a rendered path against a base directory.

Constants

MAX_RENDERED_PATH_LEN

Maximum byte length of a rendered path before it is rejected.

Functions

normalize_lexically

Lexically resolve . and .. in a path without touching the filesystem.