3 files changed, 9 insertions, 49 deletions
diff --git a/vendor/codeberg.org/gruf/go-store/storage/block.go b/vendor/codeberg.org/gruf/go-store/storage/block.go
index 112b67d80..9a8c4dc7d 100644
--- a/vendor/codeberg.org/gruf/go-store/storage/block.go
+++ b/vendor/codeberg.org/gruf/go-store/storage/block.go
@@ -585,8 +585,8 @@ func (st *BlockStorage) WalkKeys(opts WalkKeysOptions) error {
 
 // nodePathForKey calculates the node file path for supplied key
 func (st *BlockStorage) nodePathForKey(key string) (string, error) {
-	// Path separators are illegal
-	if strings.Contains(key, "/") {
+	// Path separators are illegal, as directory paths
+	if strings.Contains(key, "/") || key == "." || key == ".." {
 		return "", ErrInvalidKey
 	}
 
@@ -594,6 +594,10 @@ func (st *BlockStorage) nodePathForKey(key string) (string, error) {
 	pb := util.GetPathBuilder()
 	defer util.PutPathBuilder(pb)
 
+	// Append the nodepath to key
+	pb.AppendString(st.nodePath)
+	pb.AppendString(key)
+
 	// Return joined + cleaned node-path
 	return pb.Join(st.nodePath, key), nil
 }
diff --git a/vendor/codeberg.org/gruf/go-store/storage/disk.go b/vendor/codeberg.org/gruf/go-store/storage/disk.go
index cbc365eed..060d56688 100644
--- a/vendor/codeberg.org/gruf/go-store/storage/disk.go
+++ b/vendor/codeberg.org/gruf/go-store/storage/disk.go
@@ -69,7 +69,6 @@ func getDiskConfig(cfg *DiskConfig) DiskConfig {
 // DiskStorage is a Storage implementation that stores directly to a filesystem
 type DiskStorage struct {
 	path   string           // path is the root path of this store
-	dots   int              // dots is the "dotdot" count for the root store path
 	bufp   pools.BufferPool // bufp is the buffer pool for this DiskStorage
 	config DiskConfig       // cfg is the supplied configuration for this store
 }
@@ -120,7 +119,6 @@ func OpenFile(path string, cfg *DiskConfig) (*DiskStorage, error) {
 	// Return new DiskStorage
 	return &DiskStorage{
 		path:   path,
-		dots:   util.CountDotdots(path),
 		bufp:   pools.NewBufferPool(config.WriteBufSize),
 		config: config,
 	}, nil
@@ -282,10 +280,10 @@ func (st *DiskStorage) filepath(key string) (string, error) {
 	pb.AppendString(st.path)
 	pb.AppendString(key)
 
-	// If path is dir traversal, and traverses FURTHER
-	// than store root, this is an error
-	if util.CountDotdots(pb.StringPtr()) > st.dots {
+	// Check for dir traversal outside of root
+	if util.IsDirTraversal(st.path, pb.StringPtr()) {
 		return "", ErrInvalidKey
 	}
+
 	return pb.String(), nil
 }
diff --git a/vendor/codeberg.org/gruf/go-store/storage/memory.go b/vendor/codeberg.org/gruf/go-store/storage/memory.go
index e30aef571..be60fa464 100644
--- a/vendor/codeberg.org/gruf/go-store/storage/memory.go
+++ b/vendor/codeberg.org/gruf/go-store/storage/memory.go
@@ -2,7 +2,6 @@ package storage
 
 import (
 	"io"
-	"sync"
 
 	"codeberg.org/gruf/go-bytes"
 	"codeberg.org/gruf/go-store/util"
@@ -12,14 +11,12 @@ import (
 // pairs in a Go map in-memory. The map is protected by a mutex.
 type MemoryStorage struct {
 	fs map[string][]byte
-	mu sync.Mutex
 }
 
 // OpenMemory opens a new MemoryStorage instance with internal map of 'size'.
 func OpenMemory(size int) *MemoryStorage {
 	return &MemoryStorage{
 		fs: make(map[string][]byte, size),
-		mu: sync.Mutex{},
 	}
 }
 
@@ -30,33 +27,19 @@ func (st *MemoryStorage) Clean() error {
 
 // ReadBytes implements Storage.ReadBytes().
 func (st *MemoryStorage) ReadBytes(key string) ([]byte, error) {
-	// Safely check store
-	st.mu.Lock()
 	b, ok := st.fs[key]
-	st.mu.Unlock()
-
-	// Return early if not exist
 	if !ok {
 		return nil, ErrNotFound
 	}
-
-	// Create return copy
 	return bytes.Copy(b), nil
 }
 
 // ReadStream implements Storage.ReadStream().
 func (st *MemoryStorage) ReadStream(key string) (io.ReadCloser, error) {
-	// Safely check store
-	st.mu.Lock()
 	b, ok := st.fs[key]
-	st.mu.Unlock()
-
-	// Return early if not exist
 	if !ok {
 		return nil, ErrNotFound
 	}
-
-	// Create io.ReadCloser from 'b' copy
 	b = bytes.Copy(b)
 	r := bytes.NewReader(b)
 	return util.NopReadCloser(r), nil
@@ -64,68 +47,43 @@ func (st *MemoryStorage) ReadStream(key string) (io.ReadCloser, error) {
 
 // WriteBytes implements Storage.WriteBytes().
 func (st *MemoryStorage) WriteBytes(key string, b []byte) error {
-	// Safely check store
-	st.mu.Lock()
 	_, ok := st.fs[key]
-
-	// Check for already exist
 	if ok {
-		st.mu.Unlock()
 		return ErrAlreadyExists
 	}
-
-	// Write + unlock
 	st.fs[key] = bytes.Copy(b)
-	st.mu.Unlock()
 	return nil
 }
 
 // WriteStream implements Storage.WriteStream().
 func (st *MemoryStorage) WriteStream(key string, r io.Reader) error {
-	// Read all from reader
 	b, err := io.ReadAll(r)
 	if err != nil {
 		return err
 	}
-
-	// Write to storage
 	return st.WriteBytes(key, b)
 }
 
 // Stat implements Storage.Stat().
 func (st *MemoryStorage) Stat(key string) (bool, error) {
-	st.mu.Lock()
 	_, ok := st.fs[key]
-	st.mu.Unlock()
 	return ok, nil
 }
 
 // Remove implements Storage.Remove().
 func (st *MemoryStorage) Remove(key string) error {
-	// Safely check store
-	st.mu.Lock()
 	_, ok := st.fs[key]
-
-	// Check in store
 	if !ok {
-		st.mu.Unlock()
 		return ErrNotFound
 	}
-
-	// Delete + unlock
 	delete(st.fs, key)
-	st.mu.Unlock()
 	return nil
 }
 
 // WalkKeys implements Storage.WalkKeys().
 func (st *MemoryStorage) WalkKeys(opts WalkKeysOptions) error {
-	// Safely walk storage keys
-	st.mu.Lock()
 	for key := range st.fs {
 		opts.WalkFn(entry(key))
 	}
-	st.mu.Unlock()
-
 	return nil
 }