From e87c4992b9253a1b5efa724a188825b788bea666 Mon Sep 17 00:00:00 2001
From: Devon Kirk <hyder365@users.noreply.github.com>
Date: Sat, 20 Jun 2026 19:11:31 -0400
Subject: [PATCH] protocol: validate relative paths

---
 src/protocol/Verify.cxx | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/src/protocol/Verify.cxx b/src/protocol/Verify.cxx
index 7f8c812604..709857ead9 100644
--- a/src/protocol/Verify.cxx
+++ b/src/protocol/Verify.cxx
@@ -46,8 +46,25 @@ VerifyPathUTF8(std::string_view path_utf8) noexcept
 bool
 VerifyRelativePathUTF8(std::string_view path_utf8) noexcept
 {
-	// TODO check whether it's a relative path
-	return VerifyPathUTF8(path_utf8);
+	if (!VerifyPathUTF8(path_utf8) || path_utf8.front() == '/')
+		return false;
+
+	while (!path_utf8.empty()) {
+		auto slash = path_utf8.find('/');
+		auto component = slash == path_utf8.npos
+			? path_utf8
+			: path_utf8.substr(0, slash);
+
+		if (component.empty() || component == "." || component == "..")
+			return false;
+
+		if (slash == path_utf8.npos)
+			break;
+
+		path_utf8.remove_prefix(slash + 1);
+	}
+
+	return true;
 }
 
 bool