Prevent invalid root paths

kittens/ssh/options/utils.py

@@ -2,11 +2,22 @@
 # License: GPLv3 Copyright: 2022, Kovid Goyal <kovid at kovidgoyal.net>
 
 from typing import Any, Dict, Optional, Iterable, Tuple
+import posixpath
 
 
 DELETE_ENV_VAR = '_delete_this_env_var_'
 
 
+def relative_dir(val: str) -> str:
+    if posixpath.isabs(val):
+        raise ValueError(f'Absolute paths not allowed. {val} is invalid.')
+    base = '/ffjdg'
+    q = posixpath.normpath(posixpath.join(base, val))
+    if q == base or not q.startswith(base):
+        raise ValueError(f'Paths that escape their parent dir are not allowed. {val} is not valid')
+    return posixpath.normpath(val)
+
+
 def env(val: str, current_val: Dict[str, str]) -> Iterable[Tuple[str, str]]:
     val = val.strip()
     if val: