normaliseBundlePath function

String normaliseBundlePath(String path)

Rejects paths that are absolute or escape the bundle root, and normalises separators to /.

Shared by implementations so the guarantee holds regardless of which store a host plugs in — a store that forgot the check would let a crafted bundle write outside its own tree.

Implementation

String normaliseBundlePath(String path) {
  if (path.isEmpty) {
    throw ArgumentError.value(path, 'path', 'Path must not be empty');
  }
  if (path.startsWith('/') ||
      path.startsWith(r'\') ||
      (path.length > 1 && path[1] == ':')) {
    throw ArgumentError.value(path, 'path', 'Absolute paths are not allowed');
  }
  final segments = path.split(RegExp(r'[/\\]'));
  for (final seg in segments) {
    if (seg == '..') {
      throw ArgumentError.value(path, 'path', 'Path traversal is not allowed');
    }
  }
  return segments.where((s) => s.isNotEmpty && s != '.').join('/');
}