restored_path.hpp File Reference

Confinement for file paths that arrive through restored state. More...

#include <pulp/runtime/safe_relative_path.hpp>
#include <filesystem>
#include <optional>
#include <system_error>

Go to the source code of this file.

Namespaces
namespace	pulp
namespace	pulp::audio

Functions
std::optional< std::filesystem::path >	pulp::audio::confine_restored_path (const std::filesystem::path &path, const std::filesystem::path &root)
	Resolve a path restored from state against the directory the plugin is allowed to read from.

Detailed Description

Confinement for file paths that arrive through restored state.

A host session or preset is authored by whoever saved it, so a path inside it is untrusted input: restoring it verbatim would make the plugin open any file the author named. State blobs should carry content or root-relative references, never absolute paths; this helper is the gate for the legacy blobs that still do.

What the root buys is bounded: with the user's home directory as the root (the usual default) a hostile blob is kept off system files and other users' files, but not off the user's own documents, keys, or caches, which the decoder can still be pointed at. A tighter root (a presets or IR folder) narrows that; the root itself must come from the plugin or host, never from the blob being restored. Callers adopt the returned canonical path and open that, not the blob's spelling, or a relative spelling is checked against the root but opened against the process working directory.