@@ -117,7 +117,7 @@ func ResolveIncludePath(filePath, baseDir string, cache *ImportCache) (string, e
117117 remoteLog .Printf ("Using local file resolution for: %s" , filePath )
118118 // Regular path, resolve relative to base directory
119119 fullPath := filepath .Join (baseDir , filePath )
120-
120+
121121 // Security check: ensure the resolved path is within the .github folder
122122 // baseDir should be .github or a subdirectory within it
123123 githubFolder := baseDir
@@ -130,18 +130,18 @@ func ResolveIncludePath(filePath, baseDir string, cache *ImportCache) (string, e
130130 break
131131 }
132132 }
133-
133+
134134 // Normalize paths for comparison
135135 normalizedGithubFolder := filepath .Clean (githubFolder )
136136 normalizedFullPath := filepath .Clean (fullPath )
137-
137+
138138 // Check if fullPath is within githubFolder
139139 relativePath , err := filepath .Rel (normalizedGithubFolder , normalizedFullPath )
140140 if err != nil || relativePath == ".." || strings .HasPrefix (relativePath , ".." + string (filepath .Separator )) || filepath .IsAbs (relativePath ) {
141141 remoteLog .Printf ("Security: Path escapes .github folder: %s (resolves to: %s)" , filePath , relativePath )
142- return "" , fmt .Errorf ("Security: Path %s must be within .github folder (resolves to: %s)" , filePath , relativePath )
142+ return "" , fmt .Errorf ("security: path %s must be within .github folder (resolves to: %s)" , filePath , relativePath )
143143 }
144-
144+
145145 if _ , err := os .Stat (fullPath ); os .IsNotExist (err ) {
146146 remoteLog .Printf ("Local file not found: %s" , fullPath )
147147 // Return a simple error that will be wrapped with source location by the caller
0 commit comments