io

Documentation

Overview

Package io provides secure file read and write helpers, including path validation and secure-buffer convenience functions.

Index

• Variables
• func SecureOpenFile(file string, opts SecureReadOptions, log hyperlogger.Logger) (*os.File, error)
• func SecureReadFile(file string, log hyperlogger.Logger) ([]byte, error)
• func SecureReadFileWithMaxSize(file string, maxBytes int64, log hyperlogger.Logger) ([]byte, error)
• func SecureReadFileWithOptions(file string, opts SecureReadOptions, log hyperlogger.Logger) ([]byte, error)
• func SecureReadFileWithSecureBuffer(filename string, log hyperlogger.Logger) (*memory.SecureBuffer, error)
• func SecureReadFileWithSecureBufferOptions(filename string, opts SecureReadOptions, log hyperlogger.Logger) (*memory.SecureBuffer, error)
• func SecureWriteFile(file string, data []byte, opts SecureWriteOptions, log hyperlogger.Logger) error
• type SecureReadOptions
• type SecureWriteOptions

Variables

var (
	// ErrEmptyPath indicates that a required path argument was empty.
	ErrEmptyPath = internalio.ErrEmptyPath
	// ErrInvalidPath indicates that a path failed validation.
	ErrInvalidPath = internalio.ErrInvalidPath
	// ErrAbsolutePathNotAllowed indicates absolute paths are disallowed by policy.
	ErrAbsolutePathNotAllowed = internalio.ErrAbsolutePathNotAllowed
	// ErrPathEscapesRoot indicates the resolved path is outside the allowed roots.
	ErrPathEscapesRoot = internalio.ErrPathEscapesRoot
	// ErrSymlinkNotAllowed indicates a symlink was encountered when disallowed.
	ErrSymlinkNotAllowed = internalio.ErrSymlinkNotAllowed
	// ErrFileTooLarge indicates a file exceeds the configured maximum size.
	ErrFileTooLarge = internalio.ErrFileTooLarge
	// ErrNonRegularFile indicates a non-regular file was encountered when disallowed.
	ErrNonRegularFile = internalio.ErrNonRegularFile
	// ErrInvalidBaseDir indicates the base directory is invalid.
	ErrInvalidBaseDir = internalio.ErrInvalidBaseDir
	// ErrInvalidAllowedRoots indicates the allowed roots list is invalid.
	ErrInvalidAllowedRoots = internalio.ErrInvalidAllowedRoots
	// ErrMaxSizeInvalid indicates the configured max size is invalid.
	ErrMaxSizeInvalid = internalio.ErrMaxSizeInvalid
	// ErrFileExists indicates a write target already exists when exclusive creation is requested.
	ErrFileExists = internalio.ErrFileExists
	// ErrSyncDirUnsupported indicates directory sync is not supported on this platform or filesystem.
	ErrSyncDirUnsupported = internalio.ErrSyncDirUnsupported
)

Functions

func SecureOpenFile

func SecureOpenFile(file string, opts SecureReadOptions, log hyperlogger.Logger) (*os.File, error)

SecureOpenFile opens a file for streaming reads using the provided options.

func SecureReadFile

func SecureReadFile(file string, log hyperlogger.Logger) ([]byte, error)

SecureReadFile reads a file securely and returns the contents as a byte slice. The file contents are read into memory and should be handled carefully.

func SecureReadFileWithMaxSize

func SecureReadFileWithMaxSize(file string, maxBytes int64, log hyperlogger.Logger) ([]byte, error)

SecureReadFileWithMaxSize reads a file securely and rejects files larger than maxBytes.

func SecureReadFileWithOptions

func SecureReadFileWithOptions(file string, opts SecureReadOptions, log hyperlogger.Logger) ([]byte, error)

SecureReadFileWithOptions reads a file securely using the provided options.

func SecureReadFileWithSecureBuffer

func SecureReadFileWithSecureBuffer(filename string, log hyperlogger.Logger) (*memory.SecureBuffer, error)

SecureReadFileWithSecureBuffer reads a file securely and returns the contents in a SecureBuffer for better memory protection.

func SecureReadFileWithSecureBufferOptions

func SecureReadFileWithSecureBufferOptions(
	filename string,
	opts SecureReadOptions,
	log hyperlogger.Logger,
) (*memory.SecureBuffer, error)

SecureReadFileWithSecureBufferOptions reads a file securely using the provided options and returns the contents in a SecureBuffer.

func SecureWriteFile

func SecureWriteFile(file string, data []byte, opts SecureWriteOptions, log hyperlogger.Logger) error

SecureWriteFile writes data to a file securely using the provided options.

Types

type SecureReadOptions

type SecureReadOptions struct {
	BaseDir         string
	AllowedRoots    []string
	MaxSizeBytes    int64
	AllowAbsolute   bool
	AllowSymlinks   bool
	AllowNonRegular bool
}

SecureReadOptions configures secure read behavior.

type SecureWriteOptions

type SecureWriteOptions struct {
	BaseDir         string
	AllowedRoots    []string
	MaxSizeBytes    int64
	FileMode        os.FileMode
	CreateExclusive bool
	DisableAtomic   bool
	DisableSync     bool
	SyncDir         bool
	AllowAbsolute   bool
	AllowSymlinks   bool
}

SecureWriteOptions configures secure write behavior.