Bootstrap copied BFF and local accounts with public Sendico contracts (#34)

backend/edge/shared/storage/s3key/key.go

@@ -0,0 +1,35 @@
+package s3key
+
+import (
+	"path"
+	"strings"
+
+	"git.sendico.io/tech/sxchnge/bff/pkg/merrors"
+)
+
+// Join confines an object reference to a relative S3 prefix.
+func Join(prefix, reference string) (string, error) {
+	cleanPrefix, err := cleanRelative(prefix, "prefix")
+	if err != nil {
+		return "", err
+	}
+	cleanReference, err := cleanRelative(reference, "obj_ref")
+	if err != nil {
+		return "", err
+	}
+	return path.Join(cleanPrefix, cleanReference), nil
+}
+
+func cleanRelative(value, argument string) (string, error) {
+	value = strings.TrimSpace(value)
+	for _, segment := range strings.Split(value, "/") {
+		if segment == ".." {
+			return "", merrors.InvalidArgument(argument+" is invalid", argument)
+		}
+	}
+	clean := path.Clean(value)
+	if value == "" || clean == "." || path.IsAbs(clean) || clean == ".." || strings.HasPrefix(clean, "../") {
+		return "", merrors.InvalidArgument(argument+" is invalid", argument)
+	}
+	return clean, nil
+}