Add authorized Unix pipe forwarding

crates/geth-pipe/src/lib.rs

@@ -1,6 +1,7 @@
 use geth_types::{PipeId, ResourceId, UnixMillis};
 use serde::{Deserialize, Serialize};
 use std::net::SocketAddr;
+use std::path::{Component, Path, PathBuf};
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct PipeResource {
@@ -42,6 +43,8 @@ pub enum PipeError {
     InvalidTcpAddress(String),
     #[error("TCP forwarding addresses must be loopback addresses: {0}")]
     NonLoopbackTcpAddress(String),
+    #[error("invalid Unix socket path: {0}")]
+    InvalidUnixSocketPath(String),
 }
 
 pub fn validate_pipe_name(name: &str) -> Result<(), PipeError> {
@@ -75,6 +78,19 @@ pub fn validate_tcp_forward_target_addr(addr: &str) -> Result<SocketAddr, PipeEr
     Ok(addr)
 }
 
+pub fn validate_unix_forward_path(path: &Path) -> Result<PathBuf, PipeError> {
+    if path.as_os_str().is_empty() || !path.is_absolute() {
+        return Err(PipeError::InvalidUnixSocketPath(path.display().to_string()));
+    }
+    if path
+        .components()
+        .any(|component| matches!(component, Component::ParentDir))
+    {
+        return Err(PipeError::InvalidUnixSocketPath(path.display().to_string()));
+    }
+    Ok(path.to_path_buf())
+}
+
 #[must_use]
 pub fn pipe_roadmap() -> &'static str {
     "future pipes are authorized Iroh bidirectional streams for stdin/stdout and forwarding"
@@ -107,4 +123,11 @@ mod tests {
         assert!(validate_tcp_forward_target_addr("0.0.0.0:22").is_err());
         assert!(validate_tcp_forward_target_addr("192.0.2.10:22").is_err());
     }
+
+    #[test]
+    fn unix_forward_paths_must_be_absolute_without_parent_components() {
+        assert!(validate_unix_forward_path(Path::new("/tmp/geth.sock")).is_ok());
+        assert!(validate_unix_forward_path(Path::new("relative.sock")).is_err());
+        assert!(validate_unix_forward_path(Path::new("/tmp/../geth.sock")).is_err());
+    }
 }