pub fn validate_path_token(token: &str) -> Result<(), PathTokenError>Expand description
Reject a single untrusted path token (a blob id/namespace, or a
store_id/sid) that could escape the directory it is joined onto. A safe
token names exactly one child: no separator, no .., no ., no NUL, no : (a
Windows stream/drive reference), non-empty. The single gate every path builder
and every code decoder runs an untrusted token through, so traversal is refused
before any on-disk or cloud path is formed — and a decoded id is a safe single
component by the time any consumer joins it onto a directory.
Both . and .. are refused: each is a directory-relative reference that a
trailing path component normalizes away, so joining either onto dir resolves
to dir itself or its parent rather than to a child of dir.