CVE-2024-27102 (Go, published 2024-03-13T21:15Z)
Description: value: Wings is the server control plane for Pterodactyl Panel. This vulnerability impacts anyone running the affected versions of Wings. The vulnerability can potentially be used to access files and directories on the host system. The full scope of impact is exactly unknown, but reading files outside of a server's base directory (sandbox root) is possible. In order to use this exploit, an attacker must have an existing "server" allocated and controlled by Wings. Details on the exploitation of this vulnerability are embargoed until March 27th, 2024 at 18:00 UTC. In order to mitigate this vulnerability, a full rewrite of the entire server filesystem was necessary. Because of this, the size of the patch is massive, however effort was made to reduce the amount of breaking changes. Users are advised to update to version 1.11.9. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/pterodactyl/wings
Files changed:
config/config.go
go.mod
go.sum
internal/ufs/LICENSE
internal/ufs/README.md
internal/ufs/doc.go
internal/ufs/error.go
internal/ufs/file.go
internal/ufs/file_posix.go
internal/ufs/filesystem.go
internal/ufs/fs_quota.go
internal/ufs/fs_unix.go
internal/ufs/fs_unix_test.go
internal/ufs/go.LICENSE
internal/ufs/mkdir_unix.go
internal/ufs/path_unix.go
internal/ufs/quota_writer.go
internal/ufs/removeall_unix.go
internal/ufs/stat_unix.go
internal/ufs/walk.go
internal/ufs/walk_unix.go
parser/helpers.go
parser/parser.go
router/downloader/downloader.go
router/router_download.go
router/router_server.go
router/router_server_files.go
router/router_transfer.go
server/backup.go
server/backup/backup.go
server/backup/backup_local.go
server/backup/backup_s3.go
server/config_parser.go
server/filesystem/archive.go
server/filesystem/archive_test.go
server/filesystem/compress.go
server/filesystem/compress_test.go
server/filesystem/disk_space.go
server/filesystem/errors.go
server/filesystem/filesystem.go
server/filesystem/filesystem_test.go
server/filesystem/path.go
server/filesystem/path_test.go
server/filesystem/stat.go
server/filesystem/stat_linux.go
server/install.go
server/manager.go
server/transfer/archive.go
sftp/handler.go
Commit message: server(filesystem): rebuild everything imaginable

This wonderfully large commit replaces basically everything under the
`server/filesystem` package, re-implementing essentially everything.

This is related to
https://github.com/pterodactyl/wings/security/advisories/GHSA-494h-9924-xww9

If any vulnerabilities related to symlinks persist after this commit, I
will be very upset.

Signed-off-by: Matthew Penner <me@matthewp.io>


Vulnerable code:
	github.com/karrick/godirwalk v1.17.0
	github.com/klauspost/compress v1.17.7 // indirect
	golang.org/x/sys v0.18.0 // indirect
github.com/karrick/godirwalk v1.17.0 h1:b4kY7nqDdioR/6qnbHQyDvmA17u5G1cZ6J+CZXwSWoI=
github.com/karrick/godirwalk v1.17.0/go.mod h1:j4mkqPuvaLI8mp1DroR3P6ad7cyYd4c1qeJ3RV7ULlk=
	"io"
	"os"
//   <Property value="testing"/>
// Gets the []byte representation of a configuration file to be passed through to other
// handler functions. If the file does not currently exist, it will be created.
func readFileBytes(path string) ([]byte, error) {
	file, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o644)
	if err != nil {
		return nil, err
	}
	defer file.Close()

	return io.ReadAll(file)
}

	"os"
	"path/filepath"
// Parses a given configuration file and updates all of the values within as defined
// in the API response from the Panel.
func (f *ConfigurationFile) Parse(path string, internal bool) error {
	log.WithField("path", path).WithField("parser", f.Parser.String()).Debug("parsing server configuration file")
		err = f.parsePropertiesFile(path)
		break
		err = f.parseTextFile(path)
		break
		err = f.parseYamlFile(path)
		break
		err = f.parseJsonFile(path)
		break
		err = f.parseIniFile(path)
		break
		err = f.parseXmlFile(path)
		break

	if errors.Is(err, os.ErrNotExist) {
		// File doesn't exist, we tried creating it, and same error is returned? Pretty
		// sure this pathway is impossible, but if not, abort here.
		if internal {
			return nil
		}

		b := strings.TrimSuffix(path, filepath.Base(path))
		if err := os.MkdirAll(b, 0o755); err != nil {
			return errors.WithMessage(err, "failed to create base directory for missing configuration file")
		} else {
			if _, err := os.Create(path); err != nil {
				return errors.WithMessage(err, "failed to create missing configuration file")
			}
		}

		return f.Parse(path, true)
	}

func (f *ConfigurationFile) parseXmlFile(path string) error {
	file, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o644)
	if err != nil {
		return err
	}
	defer file.Close()

	// If you don't truncate the file you'll end up duplicating the data in there (or just appending
	// to the end of the file. We don't want to do that.
	// Move the cursor to the start of the file to avoid weird spacing issues.
	file.Seek(0, 0)

	// Truncate the file before attempting to write the changes.
	if err := os.Truncate(path, 0); err != nil {

	// Write the XML to the file.
	_, err = doc.WriteTo(file)

	return err
func (f *ConfigurationFile) parseIniFile(path string) error {
	// Ini package can't handle a non-existent file, so handle that automatically here
	// by creating it if not exists. Then, immediately close the file since we will use
	// other methods to write the new contents.
	file, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o644)
	if err != nil {
		return err
	}
	file.Close()

	cfg, err := ini.Load(path)
	return cfg.SaveTo(path)
func (f *ConfigurationFile) parseJsonFile(path string) error {
	b, err := readFileBytes(path)
	output := []byte(data.StringIndent("", "    "))
	return os.WriteFile(path, output, 0o644)
func (f *ConfigurationFile) parseYamlFile(path string) error {
	b, err := readFileBytes(path)
	return os.WriteFile(path, marshaled, 0o644)
func (f *ConfigurationFile) parseTextFile(path string) error {
	input, err := os.ReadFile(path)
	if err != nil {
		return err
	}

	lines := strings.Split(string(input), "\n")
	for i, line := range lines {
			if !strings.HasPrefix(line, replace.Match) {

			lines[i] = replace.ReplaceWith.String()
	if err := os.WriteFile(path, []byte(strings.Join(lines, "\n")), 0o644); err != nil {
func (f *ConfigurationFile) parsePropertiesFile(path string) error {
	var s strings.Builder
	// Open the file and attempt to load any comments that currenty exist at the start
	// of the file. This is kind of a hack, but should work for a majority of users for
	// the time being.
	if fd, err := os.Open(path); err != nil {
		return errors.Wrap(err, "parser: could not open file for reading")
	} else {
		scanner := bufio.NewScanner(fd)
		// Scan until we hit a line that is not a comment that actually has content
		// on it. Keep appending the comments until that time.
		for scanner.Scan() {
			text := scanner.Text()
			if len(text) > 0 && text[0] != '#' {
				break
			}
			s.WriteString(text + "\n")
		}
		_ = fd.Close()
		if err := scanner.Err(); err != nil {
			return errors.WithStackIf(err)
	p, err := properties.LoadFile(path, properties.UTF8)
	// Open the file for writing.
	w, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o644)
	if err != nil {
	defer w.Close()
	if _, err := w.Write([]byte(s.String())); err != nil {

	// If there is a Content-Length header on this request go ahead and check that we can
	// even write the whole file before beginning this process. If there is no header present
	// we'll just have to give it a spin and see how it goes.
	if res.ContentLength > 0 {
		if err := dl.server.Filesystem().HasSpaceFor(res.ContentLength); err != nil {
			return errors.WrapIf(err, "downloader: failed to write file: not enough space")
		}
	if err := dl.server.Filesystem().Writefile(p, r); err != nil {
	p, _ := s.Filesystem().SafePath(token.FilePath)
	st, err := os.Stat(p)
	// If there is an error or we're somehow trying to download a directory, just
	// respond with the appropriate error.
	} else if st.IsDir() {
	f, err := os.Open(p)
	if err != nil {
		middleware.CaptureAndAbort(c, err)
		return
	}
	defer f.Close()

	p := "/" + strings.TrimLeft(c.Query("file"), "/")
					// NOTE: os.IsNotExist() does not work if the error is wrapped.
	if err := s.Filesystem().Writefile(f, c.Request.Body); err != nil {
		p, err := s.Filesystem().SafePath(filepath.Join(directory, header.Filename))
		if err != nil {
			middleware.CaptureAndAbort(c, err)
			return
		}

		if err := handleFileUpload(p, s, header); err != nil {
	if err := s.Filesystem().Writefile(p, file); err != nil {
	ad, err := b.Generate(s.Context(), s.Filesystem().Path(), ignored)

		if err := s.Filesystem().Writefile(file, r); err != nil {
			return err
		}
		if err := s.Filesystem().Chmod(file, info.Mode()); err != nil {

		mtime := atime
		return s.Filesystem().Chtimes(file, atime, mtime)
	Generate(context.Context, string, string) (*ArchiveDetails, error)
func (b *LocalBackup) Generate(ctx context.Context, basePath, ignore string) (*ArchiveDetails, error) {
		BasePath: basePath,
		Ignore:   ignore,
func (s *S3Backup) Generate(ctx context.Context, basePath, ignore string) (*ArchiveDetails, error) {
		BasePath: basePath,
		Ignore:   ignore,
// UpdateConfigurationFiles updates all of the defined configuration files for
			p, err := s.Filesystem().SafePath(f.FileName)
				s.Log().WithField("error", err).Error("failed to generate safe path for configuration file")

			if err := f.Parse(p, false); err != nil {
			s.Log().WithField("path", f.FileName).Debug("finished processing server configuration file")
	"fmt"
	"github.com/karrick/godirwalk"
	// BasePath is the absolute path to create the archive from where Files and Ignore are
	// relative to.
	BasePath string
// Stream .
	for _, f := range a.Files {
		if strings.HasPrefix(f, a.BasePath) {

		return fmt.Errorf("archive: all entries in Files must be absolute and within BasePath: %s\n", f)
	pw := NewTarProgress(tw, a.Progress)
	// Configure godirwalk.
	options := &godirwalk.Options{
		FollowSymbolicLinks: false,
		Unsorted:            true,
	}
	var callback godirwalk.WalkFunc

		callback = a.callback(pw, func(_ string, rp string) error {
			if i.MatchesPath(rp) {
				return godirwalk.SkipThis

		callback = a.withFilesCallback(pw)
		callback = a.callback(pw)
	// Set the callback function, wrapped with support for context cancellation.
	options.Callback = func(path string, de *godirwalk.Dirent) error {
			return callback(path, de)
	}

	// Recursively walk the path we are archiving.
	return godirwalk.Walk(a.BasePath, options)
func (a *Archive) callback(tw *TarProgress, opts ...func(path string, relative string) error) func(path string, de *godirwalk.Dirent) error {
	return func(path string, de *godirwalk.Dirent) error {
		if de.IsDir() {
		relative := filepath.ToSlash(strings.TrimPrefix(path, a.BasePath+string(filepath.Separator)))

			if err := opt(path, relative); err != nil {
		return a.addToArchive(path, relative, tw)
func (a *Archive) withFilesCallback(tw *TarProgress) func(path string, de *godirwalk.Dirent) error {
	return a.callback(tw, func(p string, rp string) error {
			if f != p && !strings.HasPrefix(strings.TrimSuffix(p, "/")+"/", strings.TrimSuffix(f, "/")+"/") {
			// will be the godirwalk.SkipThis error.
		return godirwalk.SkipThis
func (a *Archive) addToArchive(p string, rp string, w *TarProgress) error {
	// Lstat the file, this will give us the same information as Stat except that it will not
	// follow a symlink to its target automatically. This is important to avoid including
	// files that exist outside the server root unintentionally in the backup.
	s, err := os.Lstat(p)
		if os.IsNotExist(err) {
		return errors.WrapIff(err, "failed executing os.Lstat on '%s'", rp)
				log.WithField("path", rp).WithField("readlink_err", err.Error()).Warn("failed reading symlink for target path; skipping...")
		return errors.WrapIff(err, "failed to get tar#FileInfoHeader for '%s'", rp)
		header.Name = rp
	if err := w.WriteHeader(header); err != nil {
		return errors.WrapIff(err, "failed to write tar#FileInfoHeader for '%s'", rp)
	f, err := os.Open(p)
	if _, err := io.CopyBuffer(w, io.LimitReader(f, header.Size), buf); err != nil {

			rfs.reset()
		})

		g.It("throws an error when passed invalid file paths", func() {
			a := &Archive{
				BasePath: fs.Path(),
				Files: []string{
					// To use the archiver properly, this needs to be filepath.Join(BasePath, "yeet")
					// However, this test tests that we actually validate that behavior.
					"yeet",
				},
			}

			g.Assert(a.Create(context.Background(), "")).IsNotNil()
			err := fs.Writefile("test/file.txt", strings.NewReader("hello, world!\n"))
			err = fs.Writefile("test2/file.txt", strings.NewReader("hello, world!\n"))
			err = fs.Writefile("test_file.txt", strings.NewReader("hello, world!\n"))
			err = fs.Writefile("test_file.txt.old", strings.NewReader("hello, world!\n"))
				BasePath: fs.Path(),
					filepath.Join(fs.Path(), "test"),
					filepath.Join(fs.Path(), "test_file.txt"),
			
	"os"
func (fs *Filesystem) CompressFiles(dir string, paths []string) (os.FileInfo, error) {
	cleanedRootDir, err := fs.SafePath(dir)

	// Take all the paths passed in and merge them together with the root directory we've gotten.
	for i, p := range paths {
		paths[i] = filepath.Join(cleanedRootDir, p)
	cleaned, err := fs.ParallelSafePath(paths)
	a := &Archive{BasePath: cleanedRootDir, Files: cleaned}
	d := path.Join(
		cleanedRootDir,
		fmt.Sprintf("archive-%s.tar.gz", strings.ReplaceAll(time.Now().Format(time.RFC3339), ":", "")),
	)

	if err := a.Create(context.Background(), d); err != nil {
	f, err := os.Stat(d)
	if err != nil {
		_ = os.Remove(d)
	if err := fs.HasSpaceFor(f.Size()); err != nil {
		_ = os.Remove(d)
	fs.addDisk(f.Size())
	return f, nil
	source, err := fs.SafePath(filepath.Join(dir, file))
	if err != nil {
		return err
	}

	// Get the cached size in a parallel process so that if it is not cached we are not
	// waiting an unnecessary amount of time on this call.
	dirSize, err := fs.DiskUsage(false)

	fsys, err := archiver.FileSystem(ctx, source)
	var size int64
			if atomic.AddInt64(&size, info.Size())+dirSize > fs.MaxDisk() {
	source, err := fs.SafePath(filepath.Join(dir, file))
	if err != nil {
		return err
	}
	return fs.DecompressFileUnsafe(ctx, dir, source)
}

// DecompressFileUnsafe will decompress any file on the local disk without checking
// if it is owned by the server.  The file will be SAFELY decompressed and extracted
// into the server's directory.
func (fs *Filesystem) DecompressFileUnsafe(ctx context.Context, dir string, file string) error {
	// Ensure that the archive actually exists on the system.
	if _, err := os.Stat(file); err != nil {
		return errors.WithStack(err)
	}

	f, err := os.Open(file)

	if ex, ok := opts.Format.(archiver.Extractor); ok {
		return ex.Extract(ctx, opts.Reader, nil, func(ctx context.Context, f archiver.File) error {
			if f.IsDir() {
				return nil
			}
			p := filepath.Join(opts.Directory, f.NameInArchive)
			// If it is ignored, just don't do anything with the file and skip over it.
			if err := fs.IsIgnored(p); err != nil {
				return nil
			}
			r, err := f.Open()
			if err != nil {
				return err
			}
			defer r.Close()
			if err := fs.Writefile(p, r); err != nil {
				return wrapError(err, opts.FileName)
			}
			// Update the file permissions to the one set in the archive.
			if err := fs.Chmod(p, f.Mode()); err != nil {
				return wrapError(err, opts.FileName)
			}
			// Update the file modification time to the one set in the archive.
			if err := fs.Chtimes(p, f.ModTime(), f.ModTime()); err != nil {
				return wrapError(err, opts.FileName)
			}
			return nil
		})
	return nil
	"sync/atomic"
			rfs.reset()
			atomic.StoreInt64(&fs.diskUsed, 0)
			atomic.StoreInt64(&fs.diskLimit, 0)
	"syscall"
	"github.com/karrick/godirwalk"
// Update the last time that a disk space lookup was performed.
// Returns the maximum amount of disk space that this Filesystem instance is allowed to use.
	return atomic.LoadInt64(&fs.diskLimit)
// Sets the disk space limit for this Filesystem instance.
	atomic.SwapInt64(&fs.diskLimit, i)
		log.WithField("root", fs.root).WithField("error", err).Warn("failed to determine root fs directory size")
	return atomic.LoadInt64(&fs.diskUsed)
					log.WithField("root", fs.root).WithField("error", err).Warn("failed to update fs disk usage from within routine")
	return atomic.LoadInt64(&fs.diskUsed), nil
	atomic.StoreInt64(&fs.diskUsed, size)
// Determines the directory size of a given location by running parallel tasks to iterate
// through all of the folders. Returns the size in bytes. This can be a fairly taxing operation
// on locations with tons of files, so it is recommended that you cache the output.
func (fs *Filesystem) DirectorySize(dir string) (int64, error) {
	d, err := fs.SafePath(dir)
	var size int64
	var st syscall.Stat_t

	err = godirwalk.Walk(d, &godirwalk.Options{
		Unsorted: true,
		Callback: func(p string, e *godirwalk.Dirent) error {
			// If this is a symlink then resolve the final destination of it before trying to continue walking
			// over its contents. If it resolves outside the server data directory just skip everything else for
			// it. Otherwise, allow it to continue.
			if e.IsSymlink() {
				if _, err := fs.SafePath(p); err != nil {
					if IsErrorCode(err, ErrCodePathResolution) {
						return godirwalk.SkipThis
					}

					return err
				}
			}

			if !e.IsDir() {
				_ = syscall.Lstat(p, &st)
				atomic.AddInt64(&size, st.Size)
			}
		},
	})
	return size, errors.WrapIf(err, "server/filesystem: directorysize: failed to walk directory")
// Helper function to determine if a server has space available for a file of a given size.
// If space is available, no error will be returned, otherwise an ErrNotEnoughSpace error
// will be raised.
	if fs.MaxDisk() == 0 {
		return nil
	}
	s, err := fs.DiskUsage(true)
	if err != nil {
		return err
	}
	if (s + size) > fs.MaxDisk() {
	size := atomic.LoadInt64(&fs.diskUsed)

	// Sorry go gods. This is ugly but the best approach I can come up with for right
	// now without completely re-evaluating the logic we use for determining disk space.
	//
	// Normally I would just be using the atomic load right below, but I'm not sure about
	// the scenarios where it is 0 because nothing has run that would trigger a disk size
	// calculation?
	//
	// Perhaps that isn't even a concern for the sake of this?
	if !fs.isTest {
		size, _ = fs.DiskUsage(true)
	}

	// If we're dropping below 0 somehow just cap it to 0.
	if (size + i) < 0 {
		return atomic.SwapInt64(&fs.diskUsed, 0)
	}

	return atomic.AddInt64(&fs.diskUsed, i)
	"os"
	return log.WithField("subsystem", "filesystem").WithField("root", fs.root).WithField("error", err)
// for the remainder of the directory. This is assuming an os.FileInfo struct was even returned.
func (fs *Filesystem) handleWalkerError(err error, f os.FileInfo) error {
	"bufio"
	"io/ioutil"
	"path"
	"sort"
	"github.com/karrick/godirwalk"
	"github.com/pterodactyl/wings/system"
	lookupInProgress  *system.AtomicBool
	diskUsed          int64
	// The maximum amount of disk space (in bytes) that this Filesystem instance can use.
	diskLimit int64

	// The root data directory path for this Filesystem instance.
	root string

func New(root string, size int64, denylist []string) *Filesystem {
		root:              root,
		diskLimit:         size,
		lookupInProgress:  system.NewAtomicBool(false),
	}
	return fs.root
func (fs *Filesystem) File(p string) (*os.File, Stat, error) {
	cleaned, err := fs.SafePath(p)
		return nil, Stat{}, errors.WithStackIf(err)
	st, err := fs.Stat(cleaned)
		if errors.Is(err, os.ErrNotExist) {
			return nil, Stat{}, newFilesystemError(ErrNotExist, err)
		}
		return nil, Stat{}, errors.WithStackIf(err)
	}
	if st.IsDir() {
		return nil, Stat{}, newFilesystemError(ErrCodeIsDirectory, nil)
	}
	f, err := os.Open(cleaned)
	if err != nil {
		return nil, Stat{}, errors.WithStackIf(err)
func (fs *Filesystem) Touch(p string, flag int) (*os.File, error) {
	cleaned, err := fs.SafePath(p)
	if err != nil {
		return nil, err
	}
	f, err := os.OpenFile(cleaned, flag, 0o644)
	if err == nil {
		return f, nil
	}
	if f != nil {
		_ = f.Close()
	}
	// If the error is not because it doesn't exist then we just need to bail at this point.
	if !errors.Is(err, os.ErrNotExist) {
		return nil, errors.Wrap(err, "server/filesystem: touch: failed to open file handle")
	}
	// Only create and chown the directory if it doesn't exist.
	if _, err := os.Stat(filepath.Dir(cleaned)); errors.Is(err, os.ErrNotExist) {
		// Create the path leading up to the file we're trying to create, setting the final perms
		// on it as we go.
		if err := os.MkdirAll(filepath.Dir(cleaned), 0o755); err != nil {
			return nil, errors.Wrap(err, "server/filesystem: touch: failed to create directory tree")
		}
		if err := fs.Chown(filepath.Dir(cleaned)); err != nil {
			return nil, err
		}
	}
	o := &fileOpener{}
	// Try to open the file now that we have created the pathing necessary for it, and then
	// Chown that file so that the permissions don't mess with things.
	f, err = o.open(cleaned, flag, 0o644)
	if err != nil {
		return nil, errors.Wrap(err, "server/filesystem: touch: failed to open file with wait")
	}
	_ = fs.Chown(cleaned)
	return f, nil
	cleaned, err := fs.SafePath(p)
		return err
	// If the file does not exist on the system already go ahead and create the pathway
	// to it and an empty file. We'll then write to it later on after this completes.
	stat, err := os.Stat(cleaned)
	if err != nil && !os.IsNotExist(err) {
		if stat.IsDir() {
			return errors.WithStack(&Error{code: ErrCodeIsDirectory, resolved: cleaned})
		currentSize = stat.Size()
	br := bufio.NewReader(r)
	if err := fs.HasSpaceFor(int64(br.Size()) - currentSize); err != nil {
	// Touch the file and return the handle to it at this point. This will create the file,
	// any necessary directories, and set the proper owner of the file.
	file, err := fs.Touch(cleaned, os.O_RDWR|os.O_CREATE|os.O_TRUNC)
	buf := make([]byte, 1024*4)
	sz, err := io.CopyBuffer(file, r, buf)
	fs.addDisk(sz - currentSize)
	return fs.unsafeChown(cleaned)
}

// Creates a new directory (name) at a specified path (p) for the server.
func (fs *Filesystem) CreateDirectory(name string, p string) error {
	cleaned, err := fs.SafePath(path.Join(p, name))
	if err != nil {
	return os.MkdirAll(cleaned, 0o755)
// Rename moves (or renames) a file or directory.
func (fs *Filesystem) Rename(from string, to string) error {
	cleanedFrom, err := fs.SafePath(from)
	if err != nil {
		return errors.WithStack(err)
	}

	cleanedTo, err := fs.SafePath(to)
	if err != nil {
		return errors.WithStack(err)
	}
	// If the target file or directory already exists the rename function will fail, so just
	// bail out now.
	if _, err := os.Stat(cleanedTo); err == nil {
		return os.ErrExist
	}
	if cleanedTo == fs.Path() {
		return errors.New("attempting to rename into an invalid directory space")
	}
	d := strings.TrimSuffix(cleanedTo, path.Base(cleanedTo))
	// Ensure that the directory we're moving into exists correctly on the system. Only do this if
	// we're not at the root directory level.
	if d != fs.Path() {
		if mkerr := os.MkdirAll(d, 0o755); mkerr != nil {
			return errors.WithMessage(mkerr, "failed to create directory structure for file rename")
		}
	if err := os.Rename(cleanedFrom, cleanedTo); err != nil {
		return errors.WithStack(err)
	}
	return nil
// Recursively iterates over a file or directory and sets the permissions on all of the
func (fs *Filesystem) Chown(path string) error {
	cleaned, err := fs.SafePath(path)
	if err != nil {
		return err
	}
	return fs.unsafeChown(cleaned)
}

// unsafeChown chowns the given path, without checking if the path is safe. This should only be used
// when the path has already been checked.
func (fs *Filesystem) unsafeChown(path string) error {
	if err := os.Chown(path, uid, gid); err != nil {
	if st, err := os.Stat(path); err != nil || !st.IsDir() {
	// If this was a directory, begin walking over its contents recursively and ensure that all
	// of the subfiles and directories get their permissions updated as well.
	err := godirwalk.Walk(path, &godirwalk.Options{
		Unsorted: true,
		Callback: func(p string, e *godirwalk.Dirent) error {
			// Do not attempt to chown a symlink. Go's os.Chown function will affect the symlink
			// so if it points to a location outside the data directory the user would be able to
			// (un)intentionally modify that files permissions.
			if e.IsSymlink() {
				if e.IsDir() {
					return godirwalk.SkipThis
				}

				return nil
			}

			return os.Chown(p, uid, gid)
		},
	})
	return errors.Wrap(err, "server/filesystem: chown: failed to chown during walk function")
}

func (fs *Filesystem) Chmod(path string, mode os.FileMode) error {
	cleaned, err := fs.SafePath(path)
	if err != nil {
		return err
	}

	if fs.isTest {

	if err := os.Chmod(cleaned, mode); err != nil {
		return err
	}

func (fs *Filesystem) findCopySuffix(dir string, name string, extension string) (string, error) {
		if _, err := fs.Stat(path.Join(dir, n)); err != nil {
			if !errors.Is(err, os.ErrNotExist) {

// Copies a given file to the same location and appends a suffix to the file to indicate that
// it has been copied.
	cleaned, err := fs.SafePath(p)

	s, err := os.Stat(cleaned)
	} else if s.IsDir() || !s.Mode().IsRegular() {
		return os.ErrNotExist
	if err := fs.HasSpaceFor(s.Size()); err != nil {
	base := filepath.Base(cleaned)
	relative := strings.TrimSuffix(strings.TrimPrefix(cleaned, fs.Path()), base)
	name := strings.TrimSuffix(base, extension)
	if strings.HasSuffix(name, ".tar") {
		name = strings.TrimSuffix(name, ".tar")
	source, err := os.Open(cleaned)
	defer source.Close()

	n, err := fs.findCopySuffix(relative, name, extension)
	return fs.Writefile(path.Join(relative, n), source)
	atomic.StoreInt64(&fs.diskUsed, 0)
	// This is one of the few (only?) places in the codebase where we're explicitly not using
	// the SafePath functionality when working with user provided input. If we did, you would
	// not be able to delete a file that is a symlink pointing to a location outside the data
	// directory.
	//
	// We also want to avoid resolving a symlink that points _within_ the data directory and thus
	// deleting the actual source file for the symlink rather than the symlink itself. For these
	// purposes just resolve the actual file path using filepath.Join() and confirm that the path
	// exists within the data directory.
	resolved := fs.unsafeFilePath(p)
	if !fs.unsafeIsInDataDirectory(resolved) {
		return NewBadPathResolution(p, resolved)
	}

	// Block any whoopsies.
	if resolved == fs.Path() {
		return errors.New("cannot delete root server directory")
	}

	st, err := os.Lstat(resolved)
	if err != nil {
		if !os.IsNotExist(err) {
			fs.error(err).Warn("error while attempting to stat file before deletion")
			return err
		}

		// The following logic is used to handle a case where a user attempts to
		// delete a file that does not exist through a directory symlink.
		// We don't want to reveal that the file does not exist, so we validate
		// the path of the symlink and return a bad path error if it is invalid.

		// The requested file or directory doesn't exist, so at this point we
		// need to iterate up the path chain until we hit a directory that
		// _does_ exist and can be validated.
		parts := strings.Split(filepath.Dir(resolved), "/")

		// Range over all the path parts and form directory paths from the end
		// moving up until we have a valid resolution, or we run out of paths to
		// try.
		for k := range parts {
			try := strings.Join(parts[:(len(parts)-k)], "/")
			if !fs.unsafeIsInDataDirectory(try) {
				break
			}

			t, err := filepath.EvalSymlinks(try)
			if err == nil {
				if !fs.unsafeIsInDataDirectory(t) {
					return NewBadPathResolution(p, t)
				}
				break
			}
		}
		// Always return early if the file does not exist.
		return nil
	}
	// If the file is not a symlink, we need to check that it is not within a
	// symlinked directory that points outside the data directory.
	if st.Mode()&os.ModeSymlink == 0 {
		ep, err := filepath.EvalSymlinks(resolved)
			if !os.IsNotExist(err) {
				return err
			}
		} else if !fs.unsafeIsInDataDirectory(ep) {
			return NewBadPathResolution(p, ep)
	}
	if st.IsDir() {
		if s, err := fs.DirectorySize(resolved); err == nil {
			fs.addDisk(-s)
	} else {
		fs.addDisk(-st.Size())
	}

	return os.RemoveAll(resolved)
}

type fileOpener struct {
	busy uint
}

// Attempts to open a given file up to "attempts" number of times, using a backoff. If the file
// cannot be opened because of a "text file busy" error, we will attempt until the number of attempts
// has been exhaused, at which point we will abort with an error.
func (fo *fileOpener) open(path string, flags int, perm os.FileMode) (*os.File, error) {
	for {
		f, err := os.OpenFile(path, flags, perm)

		// If there is an error because the text file is busy, go ahead and sleep for a few
		// hundred milliseconds and then try again up to three times before just returning the
		// error back to the caller.
		//
		// Based on code from: https://github.com/golang/go/issues/22220#issuecomment-336458122
		if err != nil && fo.busy < 3 && strings.Contains(err.Error(), "text file busy") {
			time.Sleep(100 * time.Millisecond << fo.busy)
			fo.busy++
			continue
		return f, err
	}
}

// ListDirectory lists the contents of a given directory and returns stat
// information about each file and folder within it.
func (fs *Filesystem) ListDirectory(p string) ([]Stat, error) {
	cleaned, err := fs.SafePath(p)
	if err != nil {
		return nil, err
	}

	files, err := ioutil.ReadDir(cleaned)
	var wg sync.WaitGroup

	// You must initialize the output of this directory as a non-nil value otherwise
	// when it is marshaled into a JSON object you'll just get 'null' back, which will
	// break the panel badly.
	out := make([]Stat, len(files))

	// Iterate over all of the files and directories returned and perform an async process
	// to get the mime-type for them all.
	for i, file := range files {
		wg.Add(1)

		go func(idx int, f os.FileInfo) {
			defer wg.Done()

			var m *mimetype.MIME
			d := "inode/directory"
			if !f.IsDir() {
				cleanedp := filepath.Join(cleaned, f.Name())
				if f.Mode()&os.ModeSymlink != 0 {
					cleanedp, _ = fs.SafePath(filepath.Join(cleaned, f.Name()))
				}

				// Don't try to detect the type on a pipe — this will just hang the application and
				// you'll never get a response back.
				//
				// @see https://github.com/pterodactyl/panel/issues/4059
				if cleanedp != "" && f.Mode()&os.ModeNamedPipe == 0 {
					m, _ = mimetype.DetectFile(filepath.Join(cleaned, f.Name()))
				} else {
					// Just pass this for an unknown type because the file could not safely be resolved within
					// the server data path.
					d = "application/octet-stream"
				}
			}

			st := Stat{FileInfo: f, Mimetype: d}
			if m != nil {
				st.Mimetype = m.String()
			}
			out[idx] = st
		}(i, file)
	}

	wg.Wait()

	// Sort the output alphabetically to begin with since we've run the output
	// through an asynchronous process and the order is gonna be very random.
	sort.SliceStable(out, func(i, j int) bool {
		if out[i].Name() == out[j].Name() || out[i].Name() > out[j].Name() {
			return true
		return false
	// Then, sort it so that directories are listed first in the output. Everything
	// will continue to be alphabetized at this point.
	sort.SliceStable(out, func(i, j int) bool {
		return out[i].IsDir()
	cleaned, err := fs.SafePath(path)
	if err != nil {
		return err
	}


	if err := os.Chtimes(cleaned, atime, mtime); err != nil {
		return err
	}

	return nil
	"sync/atomic"
	// defer os.RemoveAll(tmpDir)
	rfs.reset()
	fs := New(filepath.Join(tmpDir, "/server"), 0, []string{})
func getFileContent(file *os.File) string {
	f, err := os.Create(filepath.Join(rfs.root, "/server", p))
		f.Write(c)
		f.Close()
	return os.Stat(filepath.Join(rfs.root, "/server", p))
}

func (rfs *rootFs) reset() {
	if err := os.RemoveAll(filepath.Join(rfs.root, "/server")); err != nil {
		if !os.IsNotExist(err) {
			panic(err)
		}
	}

	if err := os.Mkdir(filepath.Join(rfs.root, "/server"), 0o755); err != nil {
		panic(err)
	}
			g.Assert(IsErrorCode(err, ErrNotExist)).IsTrue()
			rfs.reset()
	fs, rfs := NewFs()
			g.Assert(atomic.LoadInt64(&fs.diskUsed)).Equal(int64(0))
			err := fs.Writefile("test.txt", r)
			g.Assert(atomic.LoadInt64(&fs.diskUsed)).Equal(r.Size())
			err := fs.Writefile("/some/nested/test.txt", r)
			err := fs.Writefile("some/../foo/bar/test.txt", r)
			err := fs.Writefile("/some/../foo/../../test.txt", r)
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
			atomic.StoreInt64(&fs.diskLimit, 1024)
			err = fs.Writefile("test.txt", r)
			err := fs.Writefile("test.txt", r)
			err = fs.Writefile("test.txt", r)
			rfs.reset()

			atomic.StoreInt64(&fs.diskUsed, 0)
			atomic.StoreInt64(&fs.diskLimit, 0)
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
			g.Assert(atomic.LoadInt64(&fs.diskUsed)).Equal(int64(0))
			rfs.reset()
			g.Assert(errors.Is(err, os.ErrExist)).IsTrue()
			g.Assert(errors.Is(err, os.ErrExist)).IsTrue()
			err := fs.Rename("source.txt", "/")
			g.Assert(errors.Is(err, os.ErrExist)).IsTrue()
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
			g.Assert(errors.Is(err, os.ErrNotExist)).IsTrue()
			g.Assert(errors.Is(err, os.ErrNotExist)).IsTrue()
			g.Assert(errors.Is(err, os.ErrNotExist)).IsTrue()
			rfs.reset()
			atomic.StoreInt64(&fs.diskUsed, int64(utf8.RuneCountInString("test content")))
			g.Assert(errors.Is(err, os.ErrNotExist)).IsTrue()
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
			err := os.MkdirAll(filepath.Join(rfs.root, "/nested/in/dir"), 0o755)
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
			err := os.Mkdir(filepath.Join(rfs.root, "/server/dir"), 0o755)
			g.Assert(errors.Is(err, os.ErrNotExist)).IsTrue()
			atomic.StoreInt64(&fs.diskLimit, 2)
			g.Assert(IsErrorCode(err, ErrCodeDiskSpace)).IsTrue()
			g.Assert(atomic.LoadInt64(&fs.diskUsed)).Equal(int64(utf8.RuneCountInString("test content")) * 3)
			rfs.reset()

			atomic.StoreInt64(&fs.diskUsed, 0)
			atomic.StoreInt64(&fs.diskLimit, 0)
			atomic.StoreInt64(&fs.diskUsed, int64(utf8.RuneCountInString("test content")))
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
			g.Assert(err.Error()).Equal("cannot delete root server directory")
			g.Assert(errors.Is(err, os.ErrNotExist)).IsTrue()
			g.Assert(atomic.LoadInt64(&fs.diskUsed)).Equal(int64(0))
			atomic.StoreInt64(&fs.diskUsed, int64(utf8.RuneCountInString("test content")*3))
			g.Assert(atomic.LoadInt64(&fs.diskUsed)).Equal(int64(0))
				g.Assert(errors.Is(err, os.ErrNotExist)).IsTrue()
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
			rfs.reset()

			atomic.StoreInt64(&fs.diskUsed, 0)
			atomic.StoreInt64(&fs.diskLimit, 0)
	"context"
	iofs "io/fs"
	"os"
	"sync"
	"golang.org/x/sync/errgroup"
		sp, err := fs.SafePath(p)
		if err != nil {
			return err
		}
		if fs.denylist.MatchesPath(sp) {
			return errors.WithStack(&Error{code: ErrCodeDenylistFile, path: p, resolved: sp})
// Normalizes a directory being passed in to ensure the user is not able to escape
// from their data directory. After normalization if the directory is still within their home
// path it is returned. If they managed to "escape" an error will be returned.
//
// This logic is actually copied over from the SFTP server code. Ideally that eventually
// either gets ported into this application, or is able to make use of this package.
func (fs *Filesystem) SafePath(p string) (string, error) {
	// Start with a cleaned up path before checking the more complex bits.
	r := fs.unsafeFilePath(p)

	// At the same time, evaluate the symlink status and determine where this file or folder
	// is truly pointing to.
	ep, err := filepath.EvalSymlinks(r)
	if err != nil && !os.IsNotExist(err) {
		return "", errors.Wrap(err, "server/filesystem: failed to evaluate symlink")
	} else if os.IsNotExist(err) {
		// The target of one of the symlinks (EvalSymlinks is recursive) does not exist.
		// So we get what target path does not exist and check if it's within the data
		// directory. If it is, we return the original path, otherwise we return an error.
		pErr, ok := err.(*iofs.PathError)
		if !ok {
			return "", errors.Wrap(err, "server/filesystem: failed to evaluate symlink")
		}
		ep = pErr.Path
	}

	// If the requested directory from EvalSymlinks begins with the server root directory go
	// ahead and return it. If not we'll return an error which will block any further action
	// on the file.
	if fs.unsafeIsInDataDirectory(ep) {
		// Returning the original path here instead of the resolved path ensures that
		// whatever the user is trying to do will work as expected. If we returned the
		// resolved path, the user would be unable to know that it is in fact a symlink.
		return r, nil
	}

	return "", NewBadPathResolution(p, r)
}


// Executes the fs.SafePath function in parallel against an array of paths. If any of the calls
// fails an error will be returned.
func (fs *Filesystem) ParallelSafePath(paths []string) ([]string, error) {
	var cleaned []string

	// Simple locker function to avoid racy appends to the array of cleaned paths.
	m := new(sync.Mutex)
	push := func(c string) {
		m.Lock()
		cleaned = append(cleaned, c)
		m.Unlock()
	}

	// Create an error group that we can use to run processes in parallel while retaining
	// the ability to cancel the entire process immediately should any of it fail.
	g, ctx := errgroup.WithContext(context.Background())

	// Iterate over all of the paths and generate a cleaned path, if there is an error for any
	// of the files, abort the process.
	for _, p := range paths {
		// Create copy so we can use it within the goroutine correctly.
		pi := p

		// Recursively call this function to continue digging through the directory tree within
		// a separate goroutine. If the context is canceled abort this process.
		g.Go(func() error {
			select {
			case <-ctx.Done():
				return ctx.Err()
			default:
				// If the callback returns true, go ahead and keep walking deeper. This allows
				// us to programmatically continue deeper into directories, or stop digging
				// if that pathway knows it needs nothing else.
				if c, err := fs.SafePath(pi); err != nil {
					return err
				} else {
					push(c)
				}

				return nil
			}
		})
	}

	// Block until all of the routines finish and have returned a value.
	return cleaned, g.Wait()
}
func TestFilesystem_SafePath(t *testing.T) {
	g := Goblin(t)
	fs, rfs := NewFs()
	prefix := filepath.Join(rfs.root, "/server")

	g.Describe("SafePath", func() {
		g.It("returns a cleaned path to a given file", func() {
			p, err := fs.SafePath("test.txt")
			g.Assert(err).IsNil()
			g.Assert(p).Equal(prefix + "/test.txt")

			p, err = fs.SafePath("/test.txt")
			g.Assert(err).IsNil()
			g.Assert(p).Equal(prefix + "/test.txt")

			p, err = fs.SafePath("./test.txt")
			g.Assert(err).IsNil()
			g.Assert(p).Equal(prefix + "/test.txt")

			p, err = fs.SafePath("/foo/../test.txt")
			g.Assert(err).IsNil()
			g.Assert(p).Equal(prefix + "/test.txt")

			p, err = fs.SafePath("/foo/bar")
			g.Assert(err).IsNil()
			g.Assert(p).Equal(prefix + "/foo/bar")
		})

		g.It("handles root directory access", func() {
			p, err := fs.SafePath("/")
			g.Assert(err).IsNil()
			g.Assert(p).Equal(prefix)

			p, err = fs.SafePath("")
			g.Assert(err).IsNil()
			g.Assert(p).Equal(prefix)
		})

		g.It("removes trailing slashes from paths", func() {
			p, err := fs.SafePath("/foo/bar/")
			g.Assert(err).IsNil()
			g.Assert(p).Equal(prefix + "/foo/bar")
		})

		g.It("handles deeply nested directories that do not exist", func() {
			p, err := fs.SafePath("/foo/bar/baz/quaz/../../ducks/testing.txt")
			g.Assert(err).IsNil()
			g.Assert(p).Equal(prefix + "/foo/bar/ducks/testing.txt")
		})

		g.It("blocks access to files outside the root directory", func() {
			p, err := fs.SafePath("../test.txt")
			g.Assert(err).IsNotNil()
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
			g.Assert(p).Equal("")

			p, err = fs.SafePath("/../test.txt")
			g.Assert(err).IsNotNil()
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
			g.Assert(p).Equal("")

			p, err = fs.SafePath("./foo/../../test.txt")
			g.Assert(err).IsNotNil()
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
			g.Assert(p).Equal("")

			p, err = fs.SafePath("..")
			g.Assert(err).IsNotNil()
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
			g.Assert(p).Equal("")
		})
	})
}

			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
		g.It("cannot rename a file symlinked outside the directory root", func() {
			err := fs.Rename("symlinked.txt", "foo.txt")
			g.Assert(err).IsNotNil()
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
		g.It("cannot rename a symlinked directory outside the root", func() {
			err := fs.Rename("external_dir", "foo")
			g.Assert(err).IsNotNil()
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
			rfs.CreateServerFileFromString("my_file.txt", "internal content")
			err := fs.Rename("my_file.txt", "external_dir/my_file.txt")
			g.Assert(err).IsNotNil()
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
		})
	})
	g.Describe("Chown", func() {
		g.It("cannot chown a file symlinked outside the directory root", func() {
			err := fs.Chown("symlinked.txt")
			g.Assert(err).IsNotNil()
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
		})
		g.It("cannot chown a directory symlinked outside the directory root", func() {
			err := fs.Chown("external_dir")
			g.Assert(err).IsNotNil()
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
			g.Assert(IsErrorCode(err, ErrCodePathResolution)).IsTrue()
			g.Assert(errors.Is(err, os.ErrNotExist)).IsTrue()
	rfs.reset()
	"os"
	"github.com/goccy/go-json"
	os.FileInfo
		// Using `&os.ModePerm` on the file's mode will cause the mode to only have the permission values, and nothing else.
		ModeBits:  strconv.FormatUint(uint64(s.Mode()&os.ModePerm), 8),
		Symlink:   s.Mode().Perm()&os.ModeSymlink != 0,
// Stat stats a file or folder and returns the base stat object from go along
// with the MIME data that can be used for editing files.
func (fs *Filesystem) Stat(p string) (Stat, error) {
	cleaned, err := fs.SafePath(p)
	if err != nil {
		return Stat{}, err
	}
	return fs.unsafeStat(cleaned)
}

func (fs *Filesystem) unsafeStat(p string) (Stat, error) {
	s, err := os.Stat(p)

		m, err = mimetype.DetectFile(p)

package filesystem

import (
	"syscall"
	"time"
)

// CTime returns the time that the file/folder was created.
func (s *Stat) CTime() time.Time {
	st := s.Sys().(*syscall.Stat_t)

	return time.Unix(st.Ctimespec.Sec, st.Ctimespec.Nsec)
}
// Returns the time that the file/folder was created.
	st := s.Sys().(*syscall.Stat_t)

	// Do not remove these "redundant" type-casts, they are required for 32-bit builds to work.
	return time.Unix(int64(st.Ctim.Sec), int64(st.Ctim.Nsec))
package filesystem

import (
	"time"
)

// On linux systems this will return the time that the file was created.
// However, I have no idea how to do this on windows, so we're skipping it
// for right now.
func (s *Stat) CTime() time.Time {
	return s.ModTime()
}
	"bytes"
	// ioutil.TempDir call expects this base to exist, it won't create it for you.


	w := bufio.NewWriter(f)

	scanner := bufio.NewScanner(bytes.NewReader([]byte(ip.Script.Script)))
	for scanner.Scan() {
		w.WriteString(scanner.Text() + "\n")
	}

	if err := scanner.Err(); err != nil {

	w.Flush()

	s.fs = filesystem.New(filepath.Join(config.Get().System.Data, s.ID()), s.DiskSpace(), s.Config().Egg.FileDenylist)
			BasePath: t.Server.Filesystem().Path(),
			Progress: progress.NewProgress(size),
	"io/ioutil"
	f, err := h.fs.Touch(request.Filepath, os.O_RDWR|os.O_CREATE|os.O_TRUNC)
		source, err := h.fs.SafePath(request.Filepath)
		if err != nil {
			return sftp.ErrSSHFxNoSuchFile
		}
		target, err := h.fs.SafePath(request.Target)
		if err != nil {
			return sftp.ErrSSHFxNoSuchFile
		}
		if err := os.Symlink(source, target); err != nil {
			l.WithField("target", target).WithField("error", err).Error("failed to create symlink")
		p, err := h.fs.SafePath(request.Filepath)
		if err != nil {
			return nil, sftp.ErrSSHFxNoSuchFile
		}
		files, err := ioutil.ReadDir(p)
		return ListerAt(files), nil

Fixed code:
	"sync/atomic"
	"golang.org/x/sys/unix"

	OpenatMode string `default:"auto" yaml:"openat_mode"`

var openat2 atomic.Bool
var openat2Set atomic.Bool

func UseOpenat2() bool {
	if openat2Set.Load() {
		return openat2.Load()
	}
	defer openat2Set.Store(true)

	c := Get()
	openatMode := c.System.OpenatMode
	switch openatMode {
	case "openat2":
		openat2.Store(true)
		return true
	case "openat":
		openat2.Store(false)
		return false
	default:
		fd, err := unix.Openat2(unix.AT_FDCWD, "/", &unix.OpenHow{})
		if err != nil {
			log.WithError(err).Warn("error occurred while checking for openat2 support, falling back to openat")
			openat2.Store(false)
			return false
		}
		_ = unix.Close(fd)
		openat2.Store(true)
		return true
	}
}
	github.com/klauspost/compress v1.17.7
	golang.org/x/sys v0.18.0
MIT License

Copyright (c) 2024 Matthew Penner

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
# Filesystem

## Licensing

Most code in this package is licensed under `MIT` with some exceptions.

The following files are licensed under `BSD-3-Clause` due to them being copied
verbatim or derived from [Go](https://go.dev)'s source code.

- [`file_posix.go`](./file_posix.go)
- [`mkdir_unix.go`](./mkdir_unix.go)
- [`path_unix.go`](./path_unix.go)
- [`removeall_unix.go`](./removeall_unix.go)
- [`stat_unix.go`](./stat_unix.go) 
- [`walk.go`](./walk.go)

These changes are not associated with nor endorsed by The Go Authors.
// SPDX-License-Identifier: MIT
// SPDX-FileCopyrightText: Copyright (c) 2024 Matthew Penner

// Package ufs provides an abstraction layer for performing I/O on filesystems.
// This package is designed to be used in-place of standard `os` package I/O
// calls, and is not designed to be used as a generic filesystem abstraction
// like the `io/fs` package.
//
// The primary use-case of this package was to provide a "chroot-like" `os`
// wrapper, so we can safely sandbox I/O operations within a directory and
// use untrusted arbitrary paths.
package ufs
// SPDX-License-Identifier: MIT
// SPDX-FileCopyrightText: Copyright (c) 2024 Matthew Penner

package ufs

import (
	"errors"
	iofs "io/fs"
	"os"

	"golang.org/x/sys/unix"
)

var (
	// ErrIsDirectory is an error for when an operation that operates only on
	// files is given a path to a directory.
	ErrIsDirectory = errors.New("is a directory")
	// ErrNotDirectory is an error for when an operation that operates only on
	// directories is given a path to a file.
	ErrNotDirectory = errors.New("not a directory")
	// ErrBadPathResolution is an error for when a sand-boxed filesystem
	// resolves a given path to a forbidden location.
	ErrBadPathResolution = errors.New("bad path resolution")
	// ErrNotRegular is an error for when an operation that operates only on
	// regular files is passed something other than a regular file.
	ErrNotRegular = errors.New("not a regular file")

	// ErrClosed is an error for when an entry was accessed after being closed.
	ErrClosed = iofs.ErrClosed
	// ErrInvalid is an error for when an invalid argument was used.
	ErrInvalid = iofs.ErrInvalid
	// ErrExist is an error for when an entry already exists.
	ErrExist = iofs.ErrExist
	// ErrNotExist is an error for when an entry does not exist.
	ErrNotExist = iofs.ErrNotExist
	// ErrPermission is an error for when the required permissions to perform an
	// operation are missing.
	ErrPermission = iofs.ErrPermission
)

// LinkError records an error during a link or symlink or rename
// system call and the paths that caused it.
type LinkError = os.LinkError

// PathError records an error and the operation and file path that caused it.
type PathError = iofs.PathError

// SyscallError records an error from a specific system call.
type SyscallError = os.SyscallError

// NewSyscallError returns, as an error, a new SyscallError
// with the given system call name and error details.
// As a convenience, if err is nil, NewSyscallError returns nil.
func NewSyscallError(syscall string, err error) error {
	return os.NewSyscallError(syscall, err)
}

// convertErrorType converts errors into our custom errors to ensure consistent
// error values.
func convertErrorType(err error) error {
	if err == nil {
		return nil
	}
	var pErr *PathError
	switch {
	case errors.As(err, &pErr):
		switch {
		// File exists
		case errors.Is(pErr.Err, unix.EEXIST):
			return &PathError{
				Op:   pErr.Op,
				Path: pErr.Path,
				Err:  ErrExist,
			}
		// Is a directory
		case errors.Is(pErr.Err, unix.EISDIR):
			return &PathError{
				Op:   pErr.Op,
				Path: pErr.Path,
				Err:  ErrIsDirectory,
			}
		// Not a directory
		case errors.Is(pErr.Err, unix.ENOTDIR):
			return &PathError{
				Op:   pErr.Op,
				Path: pErr.Path,
				Err:  ErrNotDirectory,
			}
		// No such file or directory
		case errors.Is(pErr.Err, unix.ENOENT):
			return &PathError{
				Op:   pErr.Op,
				Path: pErr.Path,
				Err:  ErrNotExist,
			}
		// Operation not permitted
		case errors.Is(pErr.Err, unix.EPERM):
			return &PathError{
				Op:   pErr.Op,
				Path: pErr.Path,
				Err:  ErrPermission,
			}
		// Invalid cross-device link
		case errors.Is(pErr.Err, unix.EXDEV):
			return &PathError{
				Op:   pErr.Op,
				Path: pErr.Path,
				Err:  ErrBadPathResolution,
			}
		// Too many levels of symbolic links
		case errors.Is(pErr.Err, unix.ELOOP):
			return &PathError{
				Op:   pErr.Op,
				Path: pErr.Path,
				Err:  ErrBadPathResolution,
			}
		}
	}
	return err
}
// SPDX-License-Identifier: MIT
// SPDX-FileCopyrightText: Copyright (c) 2024 Matthew Penner

package ufs

import (
	"io"
	iofs "io/fs"

	"golang.org/x/sys/unix"
)

// DirEntry is an entry read from a directory.
type DirEntry = iofs.DirEntry

// File describes readable and/or writable file from a Filesystem.
type File interface {
	// Name returns the base name of the file.
	Name() string

	// Stat returns the FileInfo structure describing the file.
	// If there is an error, it will be of type *PathError.
	Stat() (FileInfo, error)

	// ReadDir reads the contents of the directory associated with the file f
	// and returns a slice of DirEntry values in directory order.
	// Subsequent calls on the same file will yield later DirEntry records in the directory.
	//
	// If n > 0, ReadDir returns at most n DirEntry records.
	// In this case, if ReadDir returns an empty slice, it will return an error explaining why.
	// At the end of a directory, the error is io.EOF.
	//
	// If n <= 0, ReadDir returns all the DirEntry records remaining in the directory.
	// When it succeeds, it returns a nil error (not io.EOF).
	ReadDir(n int) ([]DirEntry, error)

	// Readdirnames reads the contents of the directory associated with file
	// and returns a slice of up to n names of files in the directory,
	// in directory order. Subsequent calls on the same file will yield
	// further names.
	//
	// If n > 0, Readdirnames returns at most n names. In this case, if
	// Readdirnames returns an empty slice, it will return a non-nil error
	// explaining why. At the end of a directory, the error is io.EOF.
	//
	// If n <= 0, Readdirnames returns all the names from the directory in
	// a single slice. In this case, if Readdirnames succeeds (reads all
	// the way to the end of the directory), it returns the slice and a
	// nil error. If it encounters an error before the end of the
	// directory, Readdirnames returns the names read until that point and
	// a non-nil error.
	Readdirnames(n int) (names []string, err error)

	// Fd returns the integer Unix file descriptor referencing the open file.
	// If f is closed, the file descriptor becomes invalid.
	// If f is garbage collected, a finalizer may close the file descriptor,
	// making it invalid; see runtime.SetFinalizer for more information on when
	// a finalizer might be run. On Unix systems this will cause the SetDeadline
	// methods to stop working.
	// Because file descriptors can be reused, the returned file descriptor may
	// only be closed through the Close method of f, or by its finalizer during
	// garbage collection. Otherwise, during garbage collection the finalizer
	// may close an unrelated file descriptor with the same (reused) number.
	//
	// As an alternative, see the f.SyscallConn method.
	Fd() uintptr

	// Truncate changes the size of the file.
	// It does not change the I/O offset.
	// If there is an error, it will be of type *PathError.
	Truncate(size int64) error

	io.Closer

	io.Reader
	io.ReaderAt
	io.ReaderFrom

	io.Writer
	io.WriterAt

	io.Seeker
}

// FileInfo describes a file and is returned by Stat and Lstat.
type FileInfo = iofs.FileInfo

// FileMode represents a file's mode and permission bits.
// The bits have the same definition on all systems, so that
// information about files can be moved from one system
// to another portably. Not all bits apply to all systems.
// The only required bit is ModeDir for directories.
type FileMode = iofs.FileMode

// The defined file mode bits are the most significant bits of the FileMode.
// The nine least-significant bits are the standard Unix rwxrwxrwx permissions.
// The values of these bits should be considered part of the public API and
// may be used in wire protocols or disk representations: they must not be
// changed, although new bits might be added.
const (
	// ModeDir represents a directory.
	// d: is a directory
	ModeDir = iofs.ModeDir
	// ModeAppend represents an append-only file.
	// a: append-only
	ModeAppend = iofs.ModeAppend
	// ModeExclusive represents an exclusive file.
	// l: exclusive use
	ModeExclusive = iofs.ModeExclusive
	// ModeTemporary .
	// T: temporary file; Plan 9 only.
	ModeTemporary = iofs.ModeTemporary
	// ModeSymlink .
	// L: symbolic link.
	ModeSymlink = iofs.ModeSymlink
	// ModeDevice .
	// D: device file.
	ModeDevice = iofs.ModeDevice
	// ModeNamedPipe .
	// p: named pipe (FIFO)
	ModeNamedPipe = iofs.ModeNamedPipe
	// ModeSocket .
	// S: Unix domain socket.
	ModeSocket = iofs.ModeSocket
	// ModeSetuid .
	// u: setuid
	ModeSetuid = iofs.ModeSetuid
	// ModeSetgid .
	// g: setgid
	ModeSetgid = iofs.ModeSetgid
	// ModeCharDevice .
	// c: Unix character device, when ModeDevice is set
	ModeCharDevice = iofs.ModeCharDevice
	// ModeSticky .
	// t: sticky
	ModeSticky = iofs.ModeSticky
	// ModeIrregular .
	// ?: non-regular file; nothing else is known about this file.
	ModeIrregular = iofs.ModeIrregular

	// ModeType .
	ModeType = iofs.ModeType

	// ModePerm .
	// Unix permission bits, 0o777.
	ModePerm = iofs.ModePerm
)

const (
	// O_RDONLY opens the file read-only.
	O_RDONLY = unix.O_RDONLY
	// O_WRONLY opens the file write-only.
	O_WRONLY = unix.O_WRONLY
	// O_RDWR opens the file read-write.
	O_RDWR = unix.O_RDWR
	// O_APPEND appends data to the file when writing.
	O_APPEND = unix.O_APPEND
	// O_CREATE creates a new file if it doesn't exist.
	O_CREATE = unix.O_CREAT
	// O_EXCL is used with O_CREATE, file must not exist.
	O_EXCL = unix.O_EXCL
	// O_SYNC open for synchronous I/O.
	O_SYNC = unix.O_SYNC
	// O_TRUNC truncates regular writable file when opened.
	O_TRUNC = unix.O_TRUNC
	// O_DIRECTORY opens a directory only. If the entry is not a directory an
	// error will be returned.
	O_DIRECTORY = unix.O_DIRECTORY
	// O_NOFOLLOW opens the exact path given without following symlinks.
	O_NOFOLLOW  = unix.O_NOFOLLOW
	O_CLOEXEC   = unix.O_CLOEXEC
	O_LARGEFILE = unix.O_LARGEFILE
)

const (
	AT_SYMLINK_NOFOLLOW = unix.AT_SYMLINK_NOFOLLOW
	AT_REMOVEDIR        = unix.AT_REMOVEDIR
	AT_EMPTY_PATH       = unix.AT_EMPTY_PATH
)
// SPDX-License-Identifier: BSD-3-Clause

// Code in this file was copied from `go/src/os/file_posix.go`.

// Copyright 2009 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the `go.LICENSE` file.

//go:build unix || (js && wasm) || wasip1 || windows

package ufs

import (
	"golang.org/x/sys/unix"
)

// ignoringEINTR makes a function call and repeats it if it returns an
// EINTR error. This appears to be required even though we install all
// signal handlers with SA_RESTART: see https://go.dev/issue/22838,
// https://go.dev/issue/38033, https://go.dev/issue/38836,
// https://go.dev/issue/40846. Also, https://go.dev/issue/20400 and
// https://go.dev/issue/36644 are issues in which a signal handler is
// installed without setting SA_RESTART. None of these are the common case,
// but there are enough of them that it seems that we can't avoid
// an EINTR loop.
func ignoringEINTR(fn func() error) error {
	for {
		err := fn()
		if err != unix.EINTR {
			return err
		}
	}
}

// syscallMode returns the syscall-specific mode bits from Go's portable mode bits.
func syscallMode(i FileMode) (o FileMode) {
	o |= i.Perm()
	if i&ModeSetuid != 0 {
		o |= unix.S_ISUID
	}
	if i&ModeSetgid != 0 {
		o |= unix.S_ISGID
	}
	if i&ModeSticky != 0 {
		o |= unix.S_ISVTX
	}
	// No mapping for Go's ModeTemporary (plan9 only).
	return
}
// SPDX-License-Identifier: MIT
// SPDX-FileCopyrightText: Copyright (c) 2024 Matthew Penner

package ufs

import (
	"time"
)

// Filesystem represents a filesystem capable of performing I/O operations.
type Filesystem interface {
	// Chmod changes the mode of the named file to mode.
	//
	// If the file is a symbolic link, it changes the mode of the link's target.
	// If there is an error, it will be of type *PathError.
	//
	// A different subset of the mode bits are used, depending on the
	// operating system.
	//
	// On Unix, the mode's permission bits, ModeSetuid, ModeSetgid, and
	// ModeSticky are used.
	//
	// On Windows, only the 0200 bit (owner writable) of mode is used; it
	// controls whether the file's read-only attribute is set or cleared.
	// The other bits are currently unused. For compatibility with Go 1.12
	// and earlier, use a non-zero mode. Use mode 0400 for a read-only
	// file and 0600 for a readable+writable file.
	//
	// On Plan 9, the mode's permission bits, ModeAppend, ModeExclusive,
	// and ModeTemporary are used.
	Chmod(name string, mode FileMode) error

	// Chown changes the numeric uid and gid of the named file.
	//
	// If the file is a symbolic link, it changes the uid and gid of the link's target.
	// A uid or gid of -1 means to not change that value.
	// If there is an error, it will be of type *PathError.
	//
	// On Windows or Plan 9, Chown always returns the syscall.EWINDOWS or
	// EPLAN9 error, wrapped in *PathError.
	Chown(name string, uid, gid int) error

	// Lchown changes the numeric uid and gid of the named file.
	//
	// If the file is a symbolic link, it changes the uid and gid of the link itself.
	// If there is an error, it will be of type *PathError.
	//
	// On Windows, it always returns the syscall.EWINDOWS error, wrapped
	// in *PathError.
	Lchown(name string, uid, gid int) error

	// Chtimes changes the access and modification times of the named
	// file, similar to the Unix utime() or utimes() functions.
	//
	// The underlying filesystem may truncate or round the values to a
	// less precise time unit.
	//
	// If there is an error, it will be of type *PathError.
	Chtimes(name string, atime, mtime time.Time) error

	// Create creates or truncates the named file. If the file already exists,
	// it is truncated.
	//
	// If the file does not exist, it is created with mode 0666
	// (before umask). If successful, methods on the returned File can
	// be used for I/O; the associated file descriptor has mode O_RDWR.
	// If there is an error, it will be of type *PathError.
	Create(name string) (File, error)

	// Mkdir creates a new directory with the specified name and permission
	// bits (before umask).
	//
	// If there is an error, it will be of type *PathError.
	Mkdir(name string, perm FileMode) error

	// MkdirAll creates a directory named path, along with any necessary
	// parents, and returns nil, or else returns an error.
	//
	// The permission bits perm (before umask) are used for all
	// directories that MkdirAll creates.
	// If path is already a directory, MkdirAll does nothing
	// and returns nil.
	MkdirAll(path string, perm FileMode) error

	// Open opens the named file for reading.
	//
	// If successful, methods on the returned file can be used for reading; the
	// associated file descriptor has mode O_RDONLY.
	//
	// If there is an error, it will be of type *PathError.
	Open(name string) (File, error)

	// OpenFile is the generalized open call; most users will use Open
	// or Create instead. It opens the named file with specified flag
	// (O_RDONLY etc.).
	//
	// If the file does not exist, and the O_CREATE flag
	// is passed, it is created with mode perm (before umask). If successful,
	// methods on the returned File can be used for I/O.
	//
	// If there is an error, it will be of type *PathError.
	OpenFile(name string, flag int, perm FileMode) (File, error)

	// ReadDir reads the named directory,
	//
	// returning all its directory entries sorted by filename.
	// If an error occurs reading the directory, ReadDir returns the entries it
	// was able to read before the error, along with the error.
	ReadDir(name string) ([]DirEntry, error)

	// Remove removes the named file or (empty) directory.
	//
	// If there is an error, it will be of type *PathError.
	Remove(name string) error

	// RemoveAll removes path and any children it contains.
	//
	// It removes everything it can but returns the first error
	// it encounters. If the path does not exist, RemoveAll
	// returns nil (no error).
	//
	// If there is an error, it will be of type *PathError.
	RemoveAll(path string) error

	// Rename renames (moves) oldpath to newpath.
	//
	// If newpath already exists and is not a directory, Rename replaces it.
	// OS-specific restrictions may apply when oldpath and newpath are in different directories.
	// Even within the same directory, on non-Unix platforms Rename is not an atomic operation.
	//
	// If there is an error, it will be of type *LinkError.
	Rename(oldname, newname string) error

	// Stat returns a FileInfo describing the named file.
	//
	// If there is an error, it will be of type *PathError.
	Stat(name string) (FileInfo, error)

	// Lstat returns a FileInfo describing the named file.
	//
	// If the file is a symbolic link, the returned FileInfo
	// describes the symbolic link. Lstat makes no attempt to follow the link.
	//
	// If there is an error, it will be of type *PathError.
	Lstat(name string) (FileInfo, error)

	// Symlink creates newname as a symbolic link to oldname.
	//
	// On Windows, a symlink to a non-existent oldname creates a file symlink;
	// if oldname is later created as a directory the symlink will not work.
	//
	// If there is an error, it will be of type *LinkError.
	Symlink(oldname, newname string) error

	// WalkDir walks the file tree rooted at root, calling fn for each file or
	// directory in the tree, including root.
	//
	// All errors that arise visiting files and directories are filtered by fn:
	// see the [WalkDirFunc] documentation for details.
	//
	// The files are walked in lexical order, which makes the output deterministic
	// but requires WalkDir to read an entire directory into memory before proceeding
	// to walk that directory.
	//
	// WalkDir does not follow symbolic links found in directories,
	// but if root itself is a symbolic link, its target will be walked.
	WalkDir(root string, fn WalkDirFunc) error
}
// SPDX-License-Identifier: MIT
// SPDX-FileCopyrightText: Copyright (c) 2024 Matthew Penner

package ufs

import (
	"sync/atomic"
)

type Quota struct {
	// fs is the underlying filesystem that runs the actual I/O operations.
	*UnixFS

	// limit is the size limit of the filesystem.
	//
	// limit is atomic to allow the limit to be safely changed after the
	// filesystem was created.
	//
	// A limit of `-1` disables any write operation from being performed.
	// A limit of `0` disables any limit checking.
	limit atomic.Int64

	// usage is the current usage of the filesystem.
	//
	// If usage is set to `-1`, it hasn't been calculated yet.
	usage atomic.Int64
}

func NewQuota(fs *UnixFS, limit int64) *Quota {
	qfs := Quota{UnixFS: fs}
	qfs.limit.Store(limit)
	return &qfs
}

// Close closes the filesystem.
func (fs *Quota) Close() (err error) {
	err = fs.UnixFS.Close()
	return
}

// Limit returns the limit of the filesystem.
func (fs *Quota) Limit() int64 {
	return fs.limit.Load()
}

// SetLimit returns the limit of the filesystem.
func (fs *Quota) SetLimit(newLimit int64) int64 {
	return fs.limit.Swap(newLimit)
}

// Usage returns the current usage of the filesystem.
func (fs *Quota) Usage() int64 {
	return fs.usage.Load()
}

// SetUsage updates the total usage of the filesystem.
func (fs *Quota) SetUsage(newUsage int64) int64 {
	return fs.usage.Swap(newUsage)
}

// Add adds `i` to the tracked usage total.
func (fs *Quota) Add(i int64) int64 {
	usage := fs.Usage()

	// If adding `i` to the usage will put us below 0, cap it. (`i` can be negative)
	if usage+i < 0 {
		fs.usage.Store(0)
		return 0
	}
	return fs.usage.Add(i)
}

// CanFit checks if the given size can fit in the filesystem without exceeding
// the limit of the filesystem.
func (fs *Quota) CanFit(size int64) bool {
	// Get the size limit of the filesystem.
	limit := fs.Limit()
	switch limit {
	case -1:
		// A limit of -1 means no write operations are allowed.
		return false
	case 0:
		// A limit of 0 means unlimited.
		return true
	}

	// Any other limit is a value we need to check.
	usage := fs.Usage()
	if usage == -1 {
		// We don't know what the current usage is yet.
		return true
	}

	// If the current usage + the requested size are under the limit of the
	// filesystem, allow it.
	if usage+size <= limit {
		return true
	}

	// Welp, the size would exceed the limit of the filesystem, deny it.
	return false
}

func (fs *Quota) Remove(name string) error {
	// For information on why this interface is used here, check its
	// documentation.
	s, err := fs.RemoveStat(name)
	if err != nil {
		return err
	}

	// Don't reduce the quota's usage as `name` is not a regular file.
	if !s.Mode().IsRegular() {
		return nil
	}

	// Remove the size of the deleted file from the quota usage.
	fs.Add(-s.Size())
	return nil
}

// RemoveAll removes path and any children it contains.
//
// It removes everything it can but returns the first error
// it encounters. If the path does not exist, RemoveAll
// returns nil (no error).
//
// If there is an error, it will be of type *PathError.
func (fs *Quota) RemoveAll(name string) error {
	name, err := fs.unsafePath(name)
	if err != nil {
		return err
	}
	// While removeAll internally checks this, I want to make sure we check it
	// and return the proper error so our tests can ensure that this will never
	// be a possibility.
	if name == "." {
		return &PathError{
			Op:   "removeall",
			Path: name,
			Err:  ErrBadPathResolution,
		}
	}
	return fs.removeAll(name)
}

func (fs *Quota) removeAll(path string) error {
	return removeAll(fs, path)
}

func (fs *Quota) unlinkat(dirfd int, name string, flags int) error {
	if flags == 0 {
		s, err := fs.Lstatat(dirfd, name)
		if err == nil && s.Mode().IsRegular() {
			fs.Add(-s.Size())
		}
	}
	return fs.UnixFS.unlinkat(dirfd, name, flags)
}
// SPDX-License-Identifier: MIT
// SPDX-FileCopyrightText: Copyright (c) 2024 Matthew Penner

//go:build unix

package ufs

import (
	"errors"
	"fmt"
	"os"
	"path/filepath"
	"strconv"
	"strings"
	"sync/atomic"
	"time"

	"golang.org/x/sys/unix"
)

// UnixFS is a filesystem that uses the unix package to make io calls.
//
// This is used for proper sand-boxing and full control over the exact syscalls
// being performed.
type UnixFS struct {
	// basePath is the base path for file operations to take place in.
	basePath string

	// dirfd holds the file descriptor of BasePath and is used to ensure
	// operations are restricted into descendants of BasePath.
	dirfd atomic.Int64

	// useOpenat2 controls whether the `openat2` syscall is used instead of the
	// older `openat` syscall.
	useOpenat2 bool
}

// NewUnixFS creates a new sandboxed unix filesystem. BasePath is used as the
// sandbox path, operations on BasePath itself are not allowed, but any
// operations on its descendants are. Symlinks pointing outside BasePath are
// checked and prevented from enabling an escape in a non-raceable manor.
func NewUnixFS(basePath string, useOpenat2 bool) (*UnixFS, error) {
	basePath = strings.TrimSuffix(basePath, "/")
	// We don't need Openat2, if we are given a basePath that is already unsafe
	// I give up on trying to sandbox it.
	dirfd, err := unix.Openat(AT_EMPTY_PATH, basePath, O_DIRECTORY|O_RDONLY, 0)
	if err != nil {
		return nil, convertErrorType(err)
	}

	fs := &UnixFS{
		basePath:   basePath,
		useOpenat2: useOpenat2,
	}
	fs.dirfd.Store(int64(dirfd))
	return fs, nil
}

// BasePath returns the base path of the UnixFS sandbox, file operations
// pointing outside this path are prohibited and will be blocked by all
// operations implemented by UnixFS.
func (fs *UnixFS) BasePath() string {
	return fs.basePath
}

// Close releases the file descriptor used to sandbox operations within the
// base path of the filesystem.
func (fs *UnixFS) Close() error {
	// Once closed, change dirfd to something invalid to detect when it has been
	// closed.
	defer func() {
		fs.dirfd.Store(-1)
	}()
	return unix.Close(int(fs.dirfd.Load()))
}

// Chmod changes the mode of the named file to mode.
//
// If the file is a symbolic link, it changes the mode of the link's target.
// If there is an error, it will be of type *PathError.
//
// A different subset of the mode bits are used, depending on the
// operating system.
//
// On Unix, the mode's permission bits, ModeSetuid, ModeSetgid, and
// ModeSticky are used.
//
// On Windows, only the 0200 bit (owner writable) of mode is used; it
// controls whether the file's read-only attribute is set or cleared.
// The other bits are currently unused. For compatibility with Go 1.12
// and earlier, use a non-zero mode. Use mode 0400 for a read-only
// file and 0600 for a readable+writable file.
//
// On Plan 9, the mode's permission bits, ModeAppend, ModeExclusive,
// and ModeTemporary are used.
func (fs *UnixFS) Chmod(name string, mode FileMode) error {
	dirfd, name, closeFd, err := fs.safePath(name)
	defer closeFd()
	if err != nil {
		return err
	}
	return convertErrorType(unix.Fchmodat(dirfd, name, uint32(mode), 0))
}

// Chown changes the numeric uid and gid of the named file.
//
// If the file is a symbolic link, it changes the uid and gid of the link's target.
// A uid or gid of -1 means to not change that value.
// If there is an error, it will be of type *PathError.
//
// On Windows or Plan 9, Chown always returns the syscall.EWINDOWS or
// EPLAN9 error, wrapped in *PathError.
func (fs *UnixFS) Chown(name string, uid, gid int) error {
	return fs.fchown(name, uid, gid, 0)
}

// Lchown changes the numeric uid and gid of the named file.
//
// If the file is a symbolic link, it changes the uid and gid of the link itself.
// If there is an error, it will be of type *PathError.
//
// On Windows, it always returns the syscall.EWINDOWS error, wrapped
// in *PathError.
func (fs *UnixFS) Lchown(name string, uid, gid int) error {
	// With AT_SYMLINK_NOFOLLOW, Fchownat acts like Lchown but allows us to
	// pass a dirfd.
	return fs.fchown(name, uid, gid, AT_SYMLINK_NOFOLLOW)
}

// fchown is a re-usable Fchownat syscall used by Chown and Lchown.
func (fs *UnixFS) fchown(name string, uid, gid, flags int) error {
	dirfd, name, closeFd, err := fs.safePath(name)
	defer closeFd()
	if err != nil {
		return err
	}
	return convertErrorType(unix.Fchownat(dirfd, name, uid, gid, flags))
}

// Chownat is like Chown but allows passing an existing directory file
// descriptor rather than needing to resolve one.
func (fs *UnixFS) Chownat(dirfd int, name string, uid, gid int) error {
	return convertErrorType(unix.Fchownat(dirfd, name, uid, gid, 0))
}

// Lchownat is like Lchown but allows passing an existing directory file
// descriptor rather than needing to resolve one.
func (fs *UnixFS) Lchownat(dirfd int, name string, uid, gid int) error {
	return convertErrorType(unix.Fchownat(dirfd, name, uid, gid, AT_SYMLINK_NOFOLLOW))
}

// Chtimes changes the access and modification times of the named
// file, similar to the Unix utime() or utimes() functions.
//
// The underlying filesystem may truncate or round the values to a
// less precise time unit.
//
// If there is an error, it will be of type *PathError.
func (fs *UnixFS) Chtimes(name string, atime, mtime time.Time) error {
	dirfd, name, closeFd, err := fs.safePath(name)
	defer closeFd()
	if err != nil {
		return err
	}
	return fs.Chtimesat(dirfd, name, atime, mtime)
}

// Chtimesat is like Chtimes but allows passing an existing directory file
// descriptor rather than needing to resolve one.
func (fs *UnixFS) Chtimesat(dirfd int, name string, atime, mtime time.Time) error {
	var utimes [2]unix.Timespec
	set := func(i int, t time.Time) {
		if t.IsZero() {
			utimes[i] = unix.Timespec{Sec: unix.UTIME_OMIT, Nsec: unix.UTIME_OMIT}
		} else {
			utimes[i] = unix.NsecToTimespec(t.UnixNano())
		}
	}
	set(0, atime)
	set(1, mtime)
	// This does support `AT_SYMLINK_NOFOLLOW` as well if needed.
	if err := unix.UtimesNanoAt(dirfd, name, utimes[0:], 0); err != nil {
		return convertErrorType(&PathError{Op: "chtimes", Path: name, Err: err})
	}
	return nil
}

// Create creates or truncates the named file. If the file already exists,
// it is truncated.
//
// If the file does not exist, it is created with mode 0666
// (before umask). If successful, methods on the returned File can
// be used for I/O; the associated file descriptor has mode O_RDWR.
// If there is an error, it will be of type *PathError.
func (fs *UnixFS) Create(name string) (File, error) {
	return fs.OpenFile(name, O_CREATE|O_WRONLY|O_TRUNC, 0o644)
}

// Mkdir creates a new directory with the specified name and permission
// bits (before umask).
//
// If there is an error, it will be of type *PathError.
func (fs *UnixFS) Mkdir(name string, mode FileMode) error {
	dirfd, name, closeFd, err := fs.safePath(name)
	defer closeFd()
	if err != nil {
		return err
	}
	return fs.Mkdirat(dirfd, name, mode)
}

func (fs *UnixFS) Mkdirat(dirfd int, name string, mode FileMode) error {
	return convertErrorType(unix.Mkdirat(dirfd, name, uint32(mode)))
}

// MkdirAll creates a directory named path, along with any necessary
// parents, and returns nil, or else returns an error.
//
// The permission bits perm (before umask) are used for all
// directories that MkdirAll creates.
// If path is already a directory, MkdirAll does nothing
// and returns nil.
func (fs *UnixFS) MkdirAll(name string, mode FileMode) error {
	// Ensure name is somewhat clean before continuing.
	name, err := fs.unsafePath(name)
	if err != nil {
		return err
	}
	return fs.mkdirAll(name, mode)
}

// Open opens the named file for reading.
//
// If successful, methods on the returned file can be used for reading; the
// associated file descriptor has mode O_RDONLY.
//
// If there is an error, it will be of type *PathError.
func (fs *UnixFS) Open(name string) (File, error) {
	return fs.OpenFile(name, O_RDONLY, 0)
}

// OpenFile is the generalized open call; most users will use Open
// or Create instead. It opens the named file with specified flag
// (O_RDONLY etc.).
//
// If the file does not exist, and the O_CREATE flag
// is passed, it is created with mode perm (before umask). If successful,
// methods on the returned File can be used for I/O.
//
// If there is an error, it will be of type *PathError.
func (fs *UnixFS) OpenFile(name string, flag int, mode FileMode) (File, error) {
	fd, err := fs.openFile(name, flag, mode)
	if err != nil {
		return nil, err
	}
	// Do not close `fd` here, it is passed to a file that needs the fd, the
	// caller of this function is responsible for calling Close() on the File
	// to release the file descriptor.
	return os.NewFile(uintptr(fd), name), nil
}

func (fs *UnixFS) openFile(name string, flag int, mode FileMode) (int, error) {
	dirfd, name, closeFd, err := fs.safePath(name)
	defer closeFd()
	if err != nil {
		return 0, err
	}
	return fs.openat(dirfd, name, flag, mode)
}

func (fs *UnixFS) OpenFileat(dirfd int, name string, flag int, mode FileMode) (File, error) {
	fd, err := fs.openat(dirfd, name, flag, mode)
	if err != nil {
		return nil, err
	}
	// Do not close `fd` here, it is passed to a file that needs the fd, the
	// caller of this function is responsible for calling Close() on the File
	// to release the file descriptor.
	return os.NewFile(uintptr(fd), name), nil
}

// ReadDir reads the named directory,
//
// returning all its directory entries sorted by filename.
// If an error occurs reading the directory, ReadDir returns the entries it
// was able to read before the error, along with the error.
func (fs *UnixFS) ReadDir(path string) ([]DirEntry, error) {
	dirfd, name, closeFd, err := fs.safePath(path)
	defer closeFd()
	if err != nil {
		return nil, err
	}
	fd, err := fs.openat(dirfd, name, O_DIRECTORY|O_RDONLY, 0)
	if err != nil {
		return nil, err
	}
	defer unix.Close(fd)
	return fs.readDir(fd, name, nil)
}

// RemoveStat is a combination of Stat and Remove, it is used to more
// efficiently remove a file when the caller needs to stat it before
// removing it.
//
// This optimized function exists for our QuotaFS abstraction, which needs
// to track writes to a filesystem. When removing a file, the QuotaFS needs
// to know if the entry is a file and if so, how large it is. Because we
// need to Stat a file in order to get its mode and size, we will already
// know if the entry needs to be removed by using Unlink or Rmdir. The
// standard `Remove` method just tries both Unlink and Rmdir (in that order)
// as it ends up usually being faster and more efficient than calling Stat +
// the proper operation in the first place.
func (fs *UnixFS) RemoveStat(name string) (FileInfo, error) {
	dirfd, name, closeFd, err := fs.safePath(name)
	defer closeFd()
	if err != nil {
		return nil, err
	}

	// Lstat name, we use Lstat as Unlink doesn't care about symlinks.
	s, err := fs.Lstatat(dirfd, name)
	if err != nil {
		return nil, err
	}

	if s.IsDir() {
		err = fs.unlinkat(dirfd, name, AT_REMOVEDIR) // Rmdir
	} else {
		err = fs.unlinkat(dirfd, name, 0)
	}
	if err != nil {
		return s, convertErrorType(&PathError{Op: "remove", Path: name, Err: err})
	}
	return s, nil
}

// Remove removes the named file or (empty) directory.
//
// If there is an error, it will be of type *PathError.
func (fs *UnixFS) Remove(name string) error {
	dirfd, name, closeFd, err := fs.safePath(name)
	defer closeFd()
	if err != nil {
		return err
	}

	// Prevent trying to Remove the base directory.
	if name == "." {
		return &PathError{
			Op:   "remove",
			Path: name,
			Err:  ErrBadPathResolution,
		}
	}

	// System call interface forces us to know
	// whether name is a file or directory.
	// Try both: it is cheaper on average than
	// doing a Stat plus the right one.
	err = fs.unlinkat(dirfd, name, 0)
	if err == nil {
		return nil
	}
	err1 := fs.unlinkat(dirfd, name, AT_REMOVEDIR) // Rmdir
	if err1 == nil {
		return nil
	}

	// Both failed: figure out which error to return.
	// OS X and Linux differ on whether unlink(dir)
	// returns EISDIR, so can't use that. However,
	// both agree that rmdir(file) returns ENOTDIR,
	// so we can use that to decide which error is real.
	// Rmdir might also return ENOTDIR if given a bad
	// file path, like /etc/passwd/foo, but in that case,
	// both errors will be ENOTDIR, so it's okay to
	// use the error from unlink.
	if err1 != unix.ENOTDIR {
		err = err1
	}
	return convertErrorType(&PathError{Op: "remove", Path: name, Err: err})
}

// RemoveAll removes path and any children it contains.
//
// It removes everything it can but returns the first error
// it encounters. If the path does not exist, RemoveAll
// returns nil (no error).
//
// If there is an error, it will be of type *PathError.
func (fs *UnixFS) RemoveAll(name string) error {
	name, err := fs.unsafePath(name)
	if err != nil {
		return err
	}
	// While removeAll internally checks this, I want to make sure we check it
	// and return the proper error so our tests can ensure that this will never
	// be a possibility.
	if name == "." {
		return &PathError{
			Op:   "removeall",
			Path: name,
			Err:  ErrBadPathResolution,
		}
	}
	return fs.removeAll(name)
}

func (fs *UnixFS) unlinkat(dirfd int, name string, flags int) error {
	return ignoringEINTR(func() error {
		return unix.Unlinkat(dirfd, name, flags)
	})
}

// Rename renames (moves) oldpath to newpath.
//
// If newpath already exists and is not a directory, Rename replaces it.
// OS-specific restrictions may apply when oldpath and newpath are in different directories.
// Even within the same directory, on non-Unix platforms Rename is not an atomic operation.
//
// If there is an error, it will be of type *LinkError.
func (fs *UnixFS) Rename(oldpath, newpath string) error {
	// Simple case: both paths are the same.
	if oldpath == newpath {
		return nil
	}

	olddirfd, oldname, closeFd, err := fs.safePath(oldpath)
	defer closeFd()
	if err != nil {
		return err
	}
	// Ensure that we are not trying to rename the base directory itself.
	// While unix.Renameat ends up throwing a "device or resource busy" error,
	// that doesn't mean we are protecting the system properly.
	if oldname == "." {
		return convertErrorType(&PathError{
			Op:   "rename",
			Path: oldname,
			Err:  ErrBadPathResolution,
		})
	}
	// Stat the old target to return proper errors.
	if _, err := fs.Lstatat(olddirfd, oldname); err != nil {
		return err
	}

	newdirfd, newname, closeFd2, err := fs.safePath(newpath)
	if err != nil {
		closeFd2()
		if !errors.Is(err, ErrNotExist) {
			return convertErrorType(err)
		}
		var pathErr *PathError
		if !errors.As(err, &pathErr) {
			return convertErrorType(err)
		}
		if err := fs.MkdirAll(pathErr.Path, 0o755); err != nil {
			return err
		}
		newdirfd, newname, closeFd2, err = fs.safePath(newpath)
		defer closeFd2()
		if err != nil {
			return err
		}
	} else {
		defer closeFd2()
	}

	// Ensure that we are not trying to rename the base directory itself.
	// While unix.Renameat ends up throwing a "device or resource busy" error,
	// that doesn't mean we are protecting the system properly.
	if newname == "." {
		return convertErrorType(&PathError{
			Op:   "rename",
			Path: newname,
			Err:  ErrBadPathResolution,
		})
	}
	// Stat the new target to return proper errors.
	_, err = fs.Lstatat(newdirfd, newname)
	switch {
	case err == nil:
		return convertErrorType(&PathError{
			Op:   "rename",
			Path: newname,
			Err:  ErrExist,
		})
	case !errors.Is(err, ErrNotExist):
		return err
	}
	return unix.Renameat(olddirfd, oldname, newdirfd, newname)
}

// Stat returns a FileInfo describing the named file.
//
// If there is an error, it will be of type *PathError.
func (fs *UnixFS) Stat(name string) (FileInfo, error) {
	return fs.fstat(name, 0)
}

// Statat is like Stat but allows passing an existing directory file
// descriptor rather than needing to resolve one.
func (fs *UnixFS) Statat(dirfd int, name string) (FileInfo, error) {
	return fs.fstatat(dirfd, name, 0)
}

// Lstat returns a FileInfo describing the named file.
//
// If the file is a symbolic link, the returned FileInfo
// describes the symbolic link. Lstat makes no attempt to follow the link.
//
// If there is an error, it will be of type *PathError.
func (fs *UnixFS) Lstat(name string) (FileInfo, error) {
	return fs.fstat(name, AT_SYMLINK_NOFOLLOW)
}

// Lstatat is like Lstat but allows passing an existing directory file
// descriptor rather than needing to resolve one.
func (fs *UnixFS) Lstatat(dirfd int, name string) (FileInfo, error) {
	return fs.fstatat(dirfd, name, AT_SYMLINK_NOFOLLOW)
}

func (fs *UnixFS) fstat(name string, flags int) (FileInfo, error) {
	dirfd, name, closeFd, err := fs.safePath(name)
	defer closeFd()
	if err != nil {
		return nil, err
	}
	return fs.fstatat(dirfd, name, flags)
}

func (fs *UnixFS) fstatat(dirfd int, name string, flags int) (FileInfo, error) {
	var s fileStat
	if err := ignoringEINTR(func() error {
		return unix.Fstatat(dirfd, name, &s.sys, flags)
	}); err != nil {
		return nil, &PathError{Op: "stat", Path: name, Err: err}
	}
	fillFileStatFromSys(&s, name)
	return &s, nil
}

// Symlink creates newname as a symbolic link to oldname.
//
// On Windows, a symlink to a non-existent oldname creates a file symlink;
// if oldname is later created as a directory the symlink will not work.
//
// If there is an error, it will be of type *LinkError.
func (fs *UnixFS) Symlink(oldpath, newpath string) error {
	dirfd, newpath, closeFd, err := fs.safePath(newpath)
	defer closeFd()
	if err != nil {
		return err
	}
	if err := ignoringEINTR(func() error {
		// We aren't concerned with oldpath here as a symlink can point anywhere
		// it wants.
		return unix.Symlinkat(oldpath, dirfd, newpath)
	}); err != nil {
		return &LinkError{Op: "symlink", Old: oldpath, New: newpath, Err: err}
	}
	return nil
}

// Touch will attempt to open a file for reading and/or writing. If the file
// does not exist it will be created, and any missing parent directories will
// also be created. The opened file may be truncated, only if `flag` has
// O_TRUNC set.
func (fs *UnixFS) Touch(path string, flag int, mode FileMode) (File, error) {
	if flag&O_CREATE == 0 {
		flag |= O_CREATE
	}
	dirfd, name, closeFd, err := fs.safePath(path)
	defer closeFd()
	if err == nil {
		return fs.OpenFileat(dirfd, name, flag, mode)
	}
	if !errors.Is(err, ErrNotExist) {
		return nil, err
	}
	var pathErr *PathError
	if !errors.As(err, &pathErr) {
		return nil, err
	}
	if err := fs.MkdirAll(pathErr.Path, 0o755); err != nil {
		return nil, err
	}
	// Try to open the file one more time after creating its parent directories.
	return fs.OpenFile(path, flag, mode)
}

// WalkDir walks the file tree rooted at root, calling fn for each file or
// directory in the tree, including root.
//
// All errors that arise visiting files and directories are filtered by fn:
// see the [WalkDirFunc] documentation for details.
//
// The files are walked in lexical order, which makes the output deterministic
// but requires WalkDir to read an entire directory into memory before proceeding
// to walk that directory.
//
// WalkDir does not follow symbolic links found in directories,
// but if root itself is a symbolic link, its target will be walked.
func (fs *UnixFS) WalkDir(root string, fn WalkDirFunc) error {
	return WalkDir(fs, root, fn)
}

// openat is a wrapper around both unix.Openat and unix.Openat2. If the UnixFS
// was configured to enable openat2 support, unix.Openat2 will be used instead
// of unix.Openat due to having better security properties for our use-case.
func (fs *UnixFS) openat(dirfd int, name string, flag int, mode FileMode) (int, error) {
	if flag&O_NOFOLLOW == 0 {
		flag |= O_NOFOLLOW
	}

	var fd int
	for {
		var err error
		if fs.useOpenat2 {
			fd, err = fs._openat2(dirfd, name, uint64(flag), uint64(syscallMode(mode)))
		} else {
			fd, err = fs._openat(dirfd, name, flag, uint32(syscallMode(mode)))
		}
		if err == nil {
			break
		}
		// We have to check EINTR here, per issues https://go.dev/issue/11180 and https://go.dev/issue/39237.
		if err == unix.EINTR {
			continue
		}
		return 0, convertErrorType(err)
	}

	// If we are not using openat2, do additional path checking. This assumes
	// that openat2 is using `RESOLVE_BENEATH` to avoid the same security
	// issue.
	if !fs.useOpenat2 {
		var finalPath string
		finalPath, err := filepath.EvalSymlinks(filepath.Join("/proc/self/fd/", strconv.Itoa(dirfd)))
		if err != nil {
			return fd, convertErrorType(err)
		}
		if err != nil {
			if !errors.Is(err, ErrNotExist) {
				return fd, fmt.Errorf("failed to evaluate symlink: %w", convertErrorType(err))
			}

			// The target of one of the symlinks (EvalSymlinks is recursive)
			// does not exist. So get the path that does not exist and use
			// that for further validation instead.
			var pErr *PathError
			if ok := errors.As(err, &pErr); !ok {
				return fd, fmt.Errorf("failed to evaluate symlink: %w", convertErrorType(err))
			}
			finalPath = pErr.Path
		}

		// Check if the path is within our root.
		if !fs.unsafeIsPathInsideOfBase(finalPath) {
			return fd, convertErrorType(&PathError{
				Op:   "openat",
				Path: name,
				Err:  ErrBadPathResolution,
			})
		}
	}
	return fd, nil
}

// _openat is a wrapper around unix.Openat. This method should never be directly
// called, use `openat` instead.
func (fs *UnixFS) _openat(dirfd int, name string, flag int, mode uint32) (int, error) {
	// Ensure the O_CLOEXEC flag is set.
	// Go sets this in the os package, but since we are directly using unix
	// we need to set it ourselves.
	if flag&O_CLOEXEC == 0 {
		flag |= O_CLOEXEC
	}
	// O_LARGEFILE is set by Openat for us automatically.
	fd, err := unix.Openat(dirfd, name, flag, mode)
	switch {
	case err == nil:
		return fd, nil
	case err == unix.EINTR:
		return 0, err
	case err == unix.EAGAIN:
		return 0, err
	default:
		return 0, &PathError{Op: "openat", Path: name, Err: err}
	}
}

// _openat2 is a wonderful syscall that supersedes the `openat` syscall. It has
// improved validation and security characteristics that weren't available or
// considered when `openat` was originally implemented. As such, it is only
// present in Kernel 5.6 and above.
//
// This method should never be directly called, use `openat` instead.
func (fs *UnixFS) _openat2(dirfd int, name string, flag uint64, mode uint64) (int, error) {
	// Ensure the O_CLOEXEC flag is set.
	// Go sets this when using the os package, but since we are directly using
	// the unix package we need to set it ourselves.
	if flag&O_CLOEXEC == 0 {
		flag |= O_CLOEXEC
	}
	// Ensure the O_LARGEFILE flag is set.
	// Go sets this for unix.Open, unix.Openat, but not unix.Openat2.
	if flag&O_LARGEFILE == 0 {
		flag |= O_LARGEFILE
	}
	fd, err := unix.Openat2(dirfd, name, &unix.OpenHow{
		Flags: flag,
		Mode:  mode,
		// This is the bread and butter of preventing a symlink escape, without
		// this option, we have to handle path validation fully on our own.
		//
		// This is why using Openat2 over Openat is preferred if available.
		Resolve: unix.RESOLVE_BENEATH,
	})
	switch {
	case err == nil:
		return fd, nil
	case err == unix.EINTR:
		return 0, err
	case err == unix.EAGAIN:
		return 0, err
	default:
		return 0, &PathError{Op: "openat2", Path: name, Err: err}
	}
}

func (fs *UnixFS) SafePath(path string) (int, string, func(), error) {
	return fs.safePath(path)
}

func (fs *UnixFS) safePath(path string) (dirfd int, file string, closeFd func(), err error) {
	// Default closeFd to a NO-OP.
	closeFd = func() {}

	// Use unsafePath to clean the path and strip BasePath if path is absolute.
	var name string
	name, err = fs.unsafePath(path)
	if err != nil {
		return
	}

	// Check if dirfd was closed, this will happen if (*UnixFS).Close()
	// was called.
	fsDirfd := int(fs.dirfd.Load())
	if fsDirfd == -1 {
		err = ErrClosed
		return
	}

	// Split the parent from the last element in the path, this gives us the
	// "file name" and the full path to its parent.
	var dir string
	dir, file = filepath.Split(name)
	// If dir is empty then name is not nested.
	if dir == "" {
		// We don't need to set closeFd here as it will default to a NO-OP and
		// `fs.dirfd` is re-used until the filesystem is no-longer needed.
		dirfd = fsDirfd

		// Return dirfd, name, an empty closeFd func, and no error
		return
	}

	// Dir will usually contain a trailing slash as filepath.Split doesn't
	// trim slashes.
	dir = strings.TrimSuffix(dir, "/")
	dirfd, err = fs.openat(fsDirfd, dir, O_DIRECTORY|O_RDONLY, 0)
	if dirfd != 0 {
		// Set closeFd to close the newly opened directory file descriptor.
		closeFd = func() { _ = unix.Close(dirfd) }
	}

	// Return dirfd, name, the closeFd func, and err
	return
}

// unsafePath prefixes the given path and prefixes it with the filesystem's
// base path, cleaning the result. The path returned by this function may not
// be inside the filesystem's base path, additional checks are required to
// safely use paths returned by this function.
func (fs *UnixFS) unsafePath(path string) (string, error) {
	// Calling filepath.Clean on the joined directory will resolve it to the
	// absolute path, removing any ../ type of resolution arguments, and leaving
	// us with a direct path link.
	//
	// This will also trim the existing root path off the beginning of the path
	// passed to the function since that can get a bit messy.
	r := filepath.Clean(filepath.Join(fs.basePath, strings.TrimPrefix(path, fs.basePath)))

	if fs.unsafeIsPathInsideOfBase(r) {
		// This is kinda ironic isn't it.
		// We do this as we are operating with dirfds and `*at` syscalls which
		// behave differently if given an absolute path.
		//
		// First trim the BasePath, then trim any leading slashes.
		r = strings.TrimPrefix(strings.TrimPrefix(r, fs.basePath), "/")
		// If the path is empty then return "." as the path is pointing to the
		// root.
		if r == "" {
			return ".", nil
		}
		return r, nil
	}

	return "", &PathError{
		Op:   "safePath",
		Path: path,
		Err:  ErrBadPathResolution,
	}
}

// unsafeIsPathInsideOfBase checks if the given path is inside the filesystem's
// base path.
func (fs *UnixFS) unsafeIsPathInsideOfBase(path string) bool {
	return strings.HasPrefix(
		strings.TrimSuffix(path, "/")+"/",
		fs.basePath+"/",
	)
}
// SPDX-License-Identifier: MIT
// SPDX-FileCopyrightText: Copyright (c) 2024 Matthew Penner

//go:build unix

package ufs_test

import (
	"errors"
	"os"
	"path/filepath"
	"testing"

	"github.com/pterodactyl/wings/internal/ufs"
)

type testUnixFS struct {
	*ufs.UnixFS

	TmpDir string
	Root   string
}

func (fs *testUnixFS) Cleanup() {
	_ = fs.Close()
	_ = os.RemoveAll(fs.TmpDir)
}

func newTestUnixFS() (*testUnixFS, error) {
	tmpDir, err := os.MkdirTemp(os.TempDir(), "ufs")
	if err != nil {
		return nil, err
	}
	root := filepath.Join(tmpDir, "root")
	if err := os.Mkdir(root, 0o755); err != nil {
		return nil, err
	}
	// TODO: test both disabled and enabled.
	fs, err := ufs.NewUnixFS(root, false)
	if err != nil {
		return nil, err
	}
	tfs := &testUnixFS{
		UnixFS: fs,
		TmpDir: tmpDir,
		Root:   root,
	}
	return tfs, nil
}

func TestUnixFS_Remove(t *testing.T) {
	t.Parallel()
	fs, err := newTestUnixFS()
	if err != nil {
		t.Fatal(err)
		return
	}
	defer fs.Cleanup()

	t.Run("base directory", func(t *testing.T) {
		// Try to remove the base directory.
		if err := fs.Remove(""); !errors.Is(err, ufs.ErrBadPathResolution) {
			t.Errorf("expected an a bad path resolution error, but got: %v", err)
			return
		}
	})

	t.Run("path traversal", func(t *testing.T) {
		// Try to remove the base directory.
		if err := fs.RemoveAll("../root"); !errors.Is(err, ufs.ErrBadPathResolution) {
			t.Errorf("expected an a bad path resolution error, but got: %v", err)
			return
		}
	})
}

func TestUnixFS_RemoveAll(t *testing.T) {
	t.Parallel()
	fs, err := newTestUnixFS()
	if err != nil {
		t.Fatal(err)
		return
	}
	defer fs.Cleanup()

	t.Run("base directory", func(t *testing.T) {
		// Try to remove the base directory.
		if err := fs.RemoveAll(""); !errors.Is(err, ufs.ErrBadPathResolution) {
			t.Errorf("expected an a bad path resolution error, but got: %v", err)
			return
		}
	})

	t.Run("path traversal", func(t *testing.T) {
		// Try to remove the base directory.
		if err := fs.RemoveAll("../root"); !errors.Is(err, ufs.ErrBadPathResolution) {
			t.Errorf("expected an a bad path resolution error, but got: %v", err)
			return
		}
	})
}

func TestUnixFS_Rename(t *testing.T) {
	t.Parallel()
	fs, err := newTestUnixFS()
	if err != nil {
		t.Fatal(err)
		return
	}
	defer fs.Cleanup()

	t.Run("rename base directory", func(t *testing.T) {
		// Try to rename the base directory.
		if err := fs.Rename("", "yeet"); !errors.Is(err, ufs.ErrBadPathResolution) {
			t.Errorf("expected an a bad path resolution error, but got: %v", err)
			return
		}
	})

	t.Run("rename over base directory", func(t *testing.T) {
		// Create a directory that we are going to try and move over top of the
		// existing base directory.
		if err := fs.Mkdir("overwrite_dir", 0o755); err != nil {
			t.Error(err)
			return
		}

		// Try to rename over the base directory.
		if err := fs.Rename("overwrite_dir", ""); !errors.Is(err, ufs.ErrBadPathResolution) {
			t.Errorf("expected an a bad path resolution error, but got: %v", err)
			return
		}
	})

	t.Run("directory rename", func(t *testing.T) {
		// Create a directory to rename to something else.
		if err := fs.Mkdir("test_directory", 0o755); err != nil {
			t.Error(err)
			return
		}

		// Try to rename "test_directory" to "directory".
		if err := fs.Rename("test_directory", "directory"); err != nil {
			t.Errorf("expected no error, but got: %v", err)
			return
		}

		// Sanity check
		if _, err := os.Lstat(filepath.Join(fs.Root, "directory")); err != nil {
			t.Errorf("Lstat errored when performing sanity check: %v", err)
			return
		}
	})

	t.Run("file rename", func(t *testing.T) {
		// Create a directory to rename to something else.
		if f, err := fs.Create("test_file"); err != nil {
			t.Error(err)
			return
		} else {
			_ = f.Close()
		}

		// Try to rename "test_file" to "file".
		if err := fs.Rename("test_file", "file"); err != nil {
			t.Errorf("expected no error, but got: %v", err)
			return
		}

		// Sanity check
		if _, err := os.Lstat(filepath.Join(fs.Root, "file")); err != nil {
			t.Errorf("Lstat errored when performing sanity check: %v", err)
			return
		}
	})
}

func TestUnixFS_Touch(t *testing.T) {
	t.Parallel()
	fs, err := newTestUnixFS()
	if err != nil {
		t.Fatal(err)
		return
	}
	defer fs.Cleanup()

	t.Run("base directory", func(t *testing.T) {
		path := "i_touched_a_file"
		f, err := fs.Touch(path, ufs.O_RDWR, 0o644)
		if err != nil {
			t.Error(err)
			return
		}
		_ = f.Close()

		// Sanity check
		if _, err := os.Lstat(filepath.Join(fs.Root, path)); err != nil {
			t.Errorf("Lstat errored when performing sanity check: %v", err)
			return
		}
	})

	t.Run("existing parent directory", func(t *testing.T) {
		dir := "some_parent_directory"
		if err := fs.Mkdir(dir, 0o755); err != nil {
			t.Errorf("error creating parent directory: %v", err)
			return
		}
		path := filepath.Join(dir, "i_touched_a_file")
		f, err := fs.Touch(path, ufs.O_RDWR, 0o644)
		if err != nil {
			t.Errorf("error touching file: %v", err)
			return
		}
		_ = f.Close()

		// Sanity check
		if _, err := os.Lstat(filepath.Join(fs.Root, path)); err != nil {
			t.Errorf("Lstat errored when performing sanity check: %v", err)
			return
		}
	})

	t.Run("non-existent parent directory", func(t *testing.T) {
		path := "some_other_directory/i_touched_a_file"
		f, err := fs.Touch(path, ufs.O_RDWR, 0o644)
		if err != nil {
			t.Errorf("error touching file: %v", err)
			return
		}
		_ = f.Close()

		// Sanity check
		if _, err := os.Lstat(filepath.Join(fs.Root, path)); err != nil {
			t.Errorf("Lstat errored when performing sanity check: %v", err)
			return
		}
	})

	t.Run("non-existent parent directories", func(t *testing.T) {
		path := "some_other_directory/some_directory/i_touched_a_file"
		f, err := fs.Touch(path, ufs.O_RDWR, 0o644)
		if err != nil {
			t.Errorf("error touching file: %v", err)
			return
		}
		_ = f.Close()

		// Sanity check
		if _, err := os.Lstat(filepath.Join(fs.Root, path)); err != nil {
			t.Errorf("Lstat errored when performing sanity check: %v", err)
			return
		}
	})
}
Copyright (c) 2009 The Go Authors. All rights reserved.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are
met:

   * Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
   * Redistributions in binary form must reproduce the above
copyright notice, this list of conditions and the following disclaimer
in the documentation and/or other materials provided with the
distribution.
   * Neither the name of Google Inc. nor the names of its
contributors may be used to endorse or promote products derived from
this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// SPDX-License-Identifier: BSD-3-Clause

// Code in this file was derived from `go/src/os/path.go`.

// Copyright 2009 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the `go.LICENSE` file.

//go:build unix

package ufs

import (
	"golang.org/x/sys/unix"
)

// mkdirAll is a recursive Mkdir implementation that properly handles symlinks.
func (fs *UnixFS) mkdirAll(name string, mode FileMode) error {
	// Fast path: if we can tell whether path is a directory or file, stop with success or error.
	dir, err := fs.Lstat(name)
	if err == nil {
		if dir.Mode()&ModeSymlink != 0 {
			// If the final path is a symlink, resolve its target and use that
			// to check instead.
			dir, err = fs.Stat(name)
			if err != nil {
				return err
			}
		}
		if dir.IsDir() {
			return nil
		}
		return convertErrorType(&PathError{Op: "mkdir", Path: name, Err: unix.ENOTDIR})
	}

	// Slow path: make sure parent exists and then call Mkdir for path.
	i := len(name)
	for i > 0 && name[i-1] == '/' { // Skip trailing path separator.
		i--
	}

	j := i
	for j > 0 && name[j-1] != '/' { // Scan backward over element.
		j--
	}

	if j > 1 {
		// Create parent.
		err = fs.mkdirAll(name[:j-1], mode)
		if err != nil {
			return err
		}
	}

	// Parent now exists; invoke Mkdir and use its result.
	err = fs.Mkdir(name, mode)
	if err != nil {
		// Handle arguments like "foo/." by
		// double-checking that directory doesn't exist.
		dir, err1 := fs.Lstat(name)
		if err1 == nil && dir.IsDir() {
			return nil
		}
		return err
	}
	return nil
}
// SPDX-License-Identifier: BSD-3-Clause

// Code in this file was copied from `go/src/os/path.go`
// and `go/src/os/path_unix.go`.

// Copyright 2009 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the `go.LICENSE` file.

//go:build unix

package ufs

import (
	"os"
)

// basename removes trailing slashes and the leading directory name from path name.
func basename(name string) string {
	i := len(name) - 1
	// Remove trailing slashes
	for ; i > 0 && name[i] == '/'; i-- {
		name = name[:i]
	}
	// Remove leading directory name
	for i--; i >= 0; i-- {
		if name[i] == '/' {
			name = name[i+1:]
			break
		}
	}
	return name
}

// endsWithDot reports whether the final component of path is ".".
func endsWithDot(path string) bool {
	if path == "." {
		return true
	}
	if len(path) >= 2 && path[len(path)-1] == '.' && os.IsPathSeparator(path[len(path)-2]) {
		return true
	}
	return false
}

// splitPath returns the base name and parent directory.
func splitPath(path string) (string, string) {
	// if no better parent is found, the path is relative from "here"
	dirname := "."

	// Remove all but one leading slash.
	for len(path) > 1 && path[0] == '/' && path[1] == '/' {
		path = path[1:]
	}

	i := len(path) - 1

	// Remove trailing slashes.
	for ; i > 0 && path[i] == '/'; i-- {
		path = path[:i]
	}

	// if no slashes in path, base is path
	basename := path

	// Remove leading directory path
	for i--; i >= 0; i-- {
		if path[i] == '/' {
			if i == 0 {
				dirname = path[:1]
			} else {
				dirname = path[:i]
			}
			basename = path[i+1:]
			break
		}
	}

	return dirname, basename
}
// SPDX-License-Identifier: MIT
// SPDX-FileCopyrightText: Copyright (c) 2024 Matthew Penner

package ufs

import (
	"errors"
	"io"
	"sync/atomic"
)

// CountedWriter is a writer that counts the amount of data written to the
// underlying writer.
type CountedWriter struct {
	File

	counter atomic.Int64
	err     error
}

// NewCountedWriter returns a new countedWriter that counts the amount of bytes
// written to the underlying writer.
func NewCountedWriter(f File) *CountedWriter {
	return &CountedWriter{File: f}
}

// BytesWritten returns the amount of bytes that have been written to the
// underlying writer.
func (w *CountedWriter) BytesWritten() int64 {
	return w.counter.Load()
}

// Error returns the error from the writer if any. If the error is an EOF, nil
// will be returned.
func (w *CountedWriter) Error() error {
	if errors.Is(w.err, io.EOF) {
		return nil
	}
	return w.err
}

// Write writes bytes to the underlying writer while tracking the total amount
// of bytes written.
func (w *CountedWriter) Write(p []byte) (int, error) {
	if w.err != nil {
		return 0, io.EOF
	}

	// Write is a very simple operation for us to handle.
	n, err := w.File.Write(p)
	w.counter.Add(int64(n))
	w.err = err

	// TODO: is this how we actually want to handle errors with this?
	if err == io.EOF {
		return n, io.EOF
	} else {
		return n, nil
	}
}

func (w *CountedWriter) ReadFrom(r io.Reader) (n int64, err error) {
	cr := NewCountedReader(r)
	n, err = w.File.ReadFrom(cr)
	w.counter.Add(n)
	return
}

// CountedReader is a reader that counts the amount of data read from the
// underlying reader.
type CountedReader struct {
	reader io.Reader

	counter atomic.Int64
	err     error
}

var _ io.Reader = (*CountedReader)(nil)

// NewCountedReader returns a new countedReader that counts the amount of bytes
// read from the underlying reader.
func NewCountedReader(r io.Reader) *CountedReader {
	return &CountedReader{reader: r}
}

// BytesRead returns the amount of bytes that have been read from the underlying
// reader.
func (r *CountedReader) BytesRead() int64 {
	return r.counter.Load()
}

// Error returns the error from the reader if any. If the error is an EOF, nil
// will be returned.
func (r *CountedReader) Error() error {
	if errors.Is(r.err, io.EOF) {
		return nil
	}
	return r.err
}

// Read reads bytes from the underlying reader while tracking the total amount
// of bytes read.
func (r *CountedReader) Read(p []byte) (int, error) {
	if r.err != nil {
		return 0, io.EOF
	}

	n, err := r.reader.Read(p)
	r.counter.Add(int64(n))
	r.err = err

	if err == io.EOF {
		return n, io.EOF
	} else {
		return n, nil
	}
}
// SPDX-License-Identifier: BSD-3-Clause

// Code in this file was derived from `go/src/os/removeall_at.go`.

// Copyright 2009 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the `go.LICENSE` file.

//go:build unix

package ufs

import (
	"errors"
	"io"
	"os"

	"golang.org/x/sys/unix"
)

type unixFS interface {
	Open(name string) (File, error)
	Remove(name string) error
	unlinkat(dirfd int, path string, flags int) error
}

func (fs *UnixFS) removeAll(path string) error {
	return removeAll(fs, path)
}

func removeAll(fs unixFS, path string) error {
	if path == "" {
		// fail silently to retain compatibility with previous behavior
		// of RemoveAll. See issue https://go.dev/issue/28830.
		return nil
	}

	// The rmdir system call does not permit removing ".",
	// so we don't permit it either.
	if endsWithDot(path) {
		return &PathError{Op: "removeall", Path: path, Err: unix.EINVAL}
	}

	// Simple case: if Remove works, we're done.
	err := fs.Remove(path)
	if err == nil || errors.Is(err, ErrNotExist) {
		return nil
	}

	// RemoveAll recurses by deleting the path base from
	// its parent directory
	parentDir, base := splitPath(path)

	parent, err := fs.Open(parentDir)
	if errors.Is(err, ErrNotExist) {
		// If parent does not exist, base cannot exist. Fail silently
		return nil
	}
	if err != nil {
		return err
	}
	defer parent.Close()

	if err := removeAllFrom(fs, parent, base); err != nil {
		if pathErr, ok := err.(*PathError); ok {
			pathErr.Path = parentDir + string(os.PathSeparator) + pathErr.Path
			err = pathErr
		}
		return convertErrorType(err)
	}
	return nil
}

func removeAllFrom(fs unixFS, parent File, base string) error {
	parentFd := int(parent.Fd())
	// Simple case: if Unlink (aka remove) works, we're done.
	err := fs.unlinkat(parentFd, base, 0)
	if err == nil || errors.Is(err, ErrNotExist) {
		return nil
	}

	// EISDIR means that we have a directory, and we need to
	// remove its contents.
	// EPERM or EACCES means that we don't have write permission on
	// the parent directory, but this entry might still be a directory
	// whose contents need to be removed.
	// Otherwise, just return the error.
	if err != unix.EISDIR && err != unix.EPERM && err != unix.EACCES {
		return &PathError{Op: "unlinkat", Path: base, Err: err}
	}

	// Is this a directory we need to recurse into?
	var statInfo unix.Stat_t
	statErr := ignoringEINTR(func() error {
		return unix.Fstatat(parentFd, base, &statInfo, AT_SYMLINK_NOFOLLOW)
	})
	if statErr != nil {
		if errors.Is(statErr, ErrNotExist) {
			return nil
		}
		return &PathError{Op: "fstatat", Path: base, Err: statErr}
	}
	if statInfo.Mode&unix.S_IFMT != unix.S_IFDIR {
		// Not a directory; return the error from the unix.Unlinkat.
		return &PathError{Op: "unlinkat", Path: base, Err: err}
	}

	// Remove the directory's entries.
	var recurseErr error
	for {
		const reqSize = 1024
		var respSize int

		// Open the directory to recurse into
		file, err := openFdAt(parentFd, base)
		if err != nil {
			if errors.Is(err, ErrNotExist) {
				return nil
			}
			recurseErr = &PathError{Op: "openfdat", Path: base, Err: err}
			break
		}

		for {
			numErr := 0

			names, readErr := file.Readdirnames(reqSize)
			// Errors other than EOF should stop us from continuing.
			if readErr != nil && readErr != io.EOF {
				_ = file.Close()
				if errors.Is(readErr, ErrNotExist) {
					return nil
				}
				return &PathError{Op: "readdirnames", Path: base, Err: readErr}
			}

			respSize = len(names)
			for _, name := range names {
				err := removeAllFrom(fs, file, name)
				if err != nil {
					if pathErr, ok := err.(*PathError); ok {
						pathErr.Path = base + string(os.PathSeparator) + pathErr.Path
					}
					numErr++
					if recurseErr == nil {
						recurseErr = err
					}
				}
			}

			// If we can delete any entry, break to start new iteration.
			// Otherwise, we discard current names, get next entries and try deleting them.
			if numErr != reqSize {
				break
			}
		}

		// Removing files from the directory may have caused
		// the OS to reshuffle it. Simply calling Readdirnames
		// again may skip some entries. The only reliable way
		// to avoid this is to close and re-open the
		// directory. See issue https://go.dev/issue/20841.
		_ = file.Close()

		// Finish when the end of the directory is reached
		if respSize < reqSize {
			break
		}
	}

	// Remove the directory itself.
	unlinkErr := fs.unlinkat(parentFd, base, AT_REMOVEDIR)
	if unlinkErr == nil || errors.Is(unlinkErr, ErrNotExist) {
		return nil
	}

	if recurseErr != nil {
		return recurseErr
	}
	return &PathError{Op: "unlinkat", Path: base, Err: unlinkErr}
}

// openFdAt opens path relative to the directory in fd.
// Other than that this should act like openFileNolog.
// This acts like openFileNolog rather than OpenFile because
// we are going to (try to) remove the file.
// The contents of this file are not relevant for test caching.
func openFdAt(dirfd int, name string) (File, error) {
	var fd int
	for {
		var err error
		fd, err = unix.Openat(dirfd, name, O_RDONLY|O_CLOEXEC|O_NOFOLLOW, 0)
		if err == nil {
			break
		}

		// See comment in openFileNolog.
		if err == unix.EINTR {
			continue
		}

		return nil, err
	}
	// This is stupid, os.NewFile immediately casts `fd` to an `int`, but wants
	// it to be passed as a `uintptr`.
	return os.NewFile(uintptr(fd), name), nil
}
// SPDX-License-Identifier: BSD-3-Clause

// Code in this file was copied from `go/src/os/stat_linux.go`
// and `go/src/os/types_unix.go`.

// Copyright 2009 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the `go.LICENSE` file.

//go:build unix

package ufs

import (
	"time"

	"golang.org/x/sys/unix"
)

type fileStat struct {
	name    string
	size    int64
	mode    FileMode
	modTime time.Time
	sys     unix.Stat_t
}

var _ FileInfo = (*fileStat)(nil)

func (fs *fileStat) Size() int64        { return fs.size }
func (fs *fileStat) Mode() FileMode     { return fs.mode }
func (fs *fileStat) ModTime() time.Time { return fs.modTime }
func (fs *fileStat) Sys() any           { return &fs.sys }
func (fs *fileStat) Name() string       { return fs.name }
func (fs *fileStat) IsDir() bool        { return fs.Mode().IsDir() }

func fillFileStatFromSys(fs *fileStat, name string) {
	fs.name = basename(name)
	fs.size = fs.sys.Size
	fs.modTime = time.Unix(fs.sys.Mtim.Unix())
	fs.mode = FileMode(fs.sys.Mode & 0o777)
	switch fs.sys.Mode & unix.S_IFMT {
	case unix.S_IFBLK:
		fs.mode |= ModeDevice
	case unix.S_IFCHR:
		fs.mode |= ModeDevice | ModeCharDevice
	case unix.S_IFDIR:
		fs.mode |= ModeDir
	case unix.S_IFIFO:
		fs.mode |= ModeNamedPipe
	case unix.S_IFLNK:
		fs.mode |= ModeSymlink
	case unix.S_IFREG:
		// nothing to do
	case unix.S_IFSOCK:
		fs.mode |= ModeSocket
	}
	if fs.sys.Mode&unix.S_ISGID != 0 {
		fs.mode |= ModeSetgid
	}
	if fs.sys.Mode&unix.S_ISUID != 0 {
		fs.mode |= ModeSetuid
	}
	if fs.sys.Mode&unix.S_ISVTX != 0 {
		fs.mode |= ModeSticky
	}
}
// SPDX-License-Identifier: BSD-3-Clause

// Code in this file was derived from `go/src/io/fs/walk.go`.

// Copyright 2020 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the `go.LICENSE` file.

package ufs

import (
	iofs "io/fs"
	"path"
)

// SkipDir is used as a return value from [WalkDirFunc] to indicate that
// the directory named in the call is to be skipped. It is not returned
// as an error by any function.
var SkipDir = iofs.SkipDir

// SkipAll is used as a return value from [WalkDirFunc] to indicate that
// all remaining files and directories are to be skipped. It is not returned
// as an error by any function.
var SkipAll = iofs.SkipAll

// WalkDirFunc is the type of the function called by [WalkDir] to visit
// each file or directory.
//
// The path argument contains the argument to [WalkDir] as a prefix.
// That is, if WalkDir is called with root argument "dir" and finds a file
// named "a" in that directory, the walk function will be called with
// argument "dir/a".
//
// The d argument is the [DirEntry] for the named path.
//
// The error result returned by the function controls how [WalkDir]
// continues. If the function returns the special value [SkipDir], WalkDir
// skips the current directory (path if d.IsDir() is true, otherwise
// path's parent directory). If the function returns the special value
// [SkipAll], WalkDir skips all remaining files and directories. Otherwise,
// if the function returns a non-nil error, WalkDir stops entirely and
// returns that error.
//
// The err argument reports an error related to path, signaling that
// [WalkDir] will not walk into that directory. The function can decide how
// to handle that error; as described earlier, returning the error will
// cause WalkDir to stop walking the entire tree.
//
// [WalkDir] calls the function with a non-nil err argument in two cases.
//
// First, if the initial [Stat] on the root directory fails, WalkDir
// calls the function with path set to root, d set to nil, and err set to
// the error from [fs.Stat].
//
// Second, if a directory's ReadDir method (see [ReadDirFile]) fails, WalkDir calls the
// function with path set to the directory's path, d set to an
// [DirEntry] describing the directory, and err set to the error from
// ReadDir. In this second case, the function is called twice with the
// path of the directory: the first call is before the directory read is
// attempted and has err set to nil, giving the function a chance to
// return [SkipDir] or [SkipAll] and avoid the ReadDir entirely. The second call
// is after a failed ReadDir and reports the error from ReadDir.
// (If ReadDir succeeds, there is no second call.)
type WalkDirFunc func(path string, d DirEntry, err error) error

// WalkDir walks the file tree rooted at root, calling fn for each file or
// directory in the tree, including root.
//
// All errors that arise visiting files and directories are filtered by fn:
// see the [WalkDirFunc] documentation for details.
//
// The files are walked in lexical order, which makes the output deterministic
// but requires WalkDir to read an entire directory into memory before proceeding
// to walk that directory.
//
// WalkDir does not follow symbolic links found in directories,
// but if root itself is a symbolic link, its target will be walked.
func WalkDir(fs Filesystem, root string, fn WalkDirFunc) error {
	info, err := fs.Stat(root)
	if err != nil {
		err = fn(root, nil, err)
	} else {
		err = walkDir(fs, root, iofs.FileInfoToDirEntry(info), fn)
	}
	if err == SkipDir || err == SkipAll {
		return nil
	}
	return err
}

// walkDir recursively descends path, calling walkDirFn.
func walkDir(fs Filesystem, name string, d DirEntry, walkDirFn WalkDirFunc) error {
	if err := walkDirFn(name, d, nil); err != nil || !d.IsDir() {
		if err == SkipDir && d.IsDir() {
			// Successfully skipped directory.
			err = nil
		}
		return err
	}

	dirs, err := fs.ReadDir(name)
	if err != nil {
		// Second call, to report ReadDir error.
		err = walkDirFn(name, d, err)
		if err != nil {
			if err == SkipDir && d.IsDir() {
				err = nil
			}
			return err
		}
	}

	for _, d1 := range dirs {
		name1 := path.Join(name, d1.Name())
		if err := walkDir(fs, name1, d1, walkDirFn); err != nil {
			if err == SkipDir {
				break
			}
			return err
		}
	}
	return nil
}
// SPDX-License-Identifier: BSD-2-Clause

// Some code in this file was derived from https://github.com/karrick/godirwalk.

//go:build unix

package ufs

import (
	"bytes"
	iofs "io/fs"
	"os"
	"path"
	"path/filepath"
	"reflect"
	"unsafe"

	"golang.org/x/sys/unix"
)

type WalkDiratFunc func(dirfd int, name, relative string, d DirEntry, err error) error

func (fs *UnixFS) WalkDirat(dirfd int, name string, fn WalkDiratFunc) error {
	if dirfd == 0 {
		// TODO: proper validation, ideally a dedicated function.
		dirfd = int(fs.dirfd.Load())
	}
	info, err := fs.Lstatat(dirfd, name)
	if err != nil {
		err = fn(dirfd, name, name, nil, err)
	} else {
		b := newScratchBuffer()
		err = fs.walkDir(b, dirfd, name, name, iofs.FileInfoToDirEntry(info), fn)
	}
	if err == SkipDir || err == SkipAll {
		return nil
	}
	return err
}

func (fs *UnixFS) walkDir(b []byte, parentfd int, name, relative string, d DirEntry, walkDirFn WalkDiratFunc) error {
	if err := walkDirFn(parentfd, name, relative, d, nil); err != nil || !d.IsDir() {
		if err == SkipDir && d.IsDir() {
			// Successfully skipped directory.
			err = nil
		}
		return err
	}

	dirfd, err := fs.openat(parentfd, name, O_DIRECTORY|O_RDONLY, 0)
	if err != nil {
		return err
	}
	defer unix.Close(dirfd)

	dirs, err := fs.readDir(dirfd, name, b)
	if err != nil {
		// Second call, to report ReadDir error.
		err = walkDirFn(dirfd, name, relative, d, err)
		if err != nil {
			if err == SkipDir && d.IsDir() {
				err = nil
			}
			return err
		}
	}

	for _, d1 := range dirs {
		if err := fs.walkDir(b, dirfd, d1.Name(), path.Join(relative, d1.Name()), d1, walkDirFn); err != nil {
			if err == SkipDir {
				break
			}
			return err
		}
	}
	return nil
}

// ReadDirMap .
// TODO: document
func ReadDirMap[T any](fs *UnixFS, path string, fn func(DirEntry) (T, error)) ([]T, error) {
	dirfd, name, closeFd, err := fs.safePath(path)
	defer closeFd()
	if err != nil {
		return nil, err
	}
	fd, err := fs.openat(dirfd, name, O_DIRECTORY|O_RDONLY, 0)
	if err != nil {
		return nil, err
	}
	defer unix.Close(fd)

	entries, err := fs.readDir(fd, ".", nil)
	if err != nil {
		return nil, err
	}

	out := make([]T, len(entries))
	for i, e := range entries {
		idx := i
		e := e
		v, err := fn(e)
		if err != nil {
			return nil, err
		}
		out[idx] = v
	}
	return out, nil
}

// nameOffset is a compile time constant
const nameOffset = int(unsafe.Offsetof(unix.Dirent{}.Name))

func nameFromDirent(de *unix.Dirent) (name []byte) {
	// Because this GOOS' syscall.Dirent does not provide a field that specifies
	// the name length, this function must first calculate the max possible name
	// length, and then search for the NULL byte.
	ml := int(de.Reclen) - nameOffset

	// Convert syscall.Dirent.Name, which is array of int8, to []byte, by
	// overwriting Cap, Len, and Data slice header fields to the max possible
	// name length computed above, and finding the terminating NULL byte.
	//
	// TODO: is there an alternative to the deprecated SliceHeader?
	// SliceHeader was mainly deprecated due to it being misused for avoiding
	// allocations when converting a byte slice to a string, ref;
	// https://go.dev/issue/53003
	sh := (*reflect.SliceHeader)(unsafe.Pointer(&name))
	sh.Cap = ml
	sh.Len = ml
	sh.Data = uintptr(unsafe.Pointer(&de.Name[0]))

	if index := bytes.IndexByte(name, 0); index >= 0 {
		// Found NULL byte; set slice's cap and len accordingly.
		sh.Cap = index
		sh.Len = index
		return
	}

	// NOTE: This branch is not expected, but included for defensive
	// programming, and provides a hard stop on the name based on the structure
	// field array size.
	sh.Cap = len(de.Name)
	sh.Len = sh.Cap
	return
}

// modeTypeFromDirent converts a syscall defined constant, which is in purview
// of OS, to a constant defined by Go, assumed by this project to be stable.
//
// When the syscall constant is not recognized, this function falls back to a
// Stat on the file system.
func (fs *UnixFS) modeTypeFromDirent(fd int, de *unix.Dirent, osDirname, osBasename string) (FileMode, error) {
	switch de.Type {
	case unix.DT_REG:
		return 0, nil
	case unix.DT_DIR:
		return ModeDir, nil
	case unix.DT_LNK:
		return ModeSymlink, nil
	case unix.DT_CHR:
		return ModeDevice | ModeCharDevice, nil
	case unix.DT_BLK:
		return ModeDevice, nil
	case unix.DT_FIFO:
		return ModeNamedPipe, nil
	case unix.DT_SOCK:
		return ModeSocket, nil
	default:
		// If syscall returned unknown type (e.g., DT_UNKNOWN, DT_WHT), then
		// resolve actual mode by reading file information.
		return fs.modeType(fd, filepath.Join(osDirname, osBasename))
	}
}

// modeType returns the mode type of the file system entry identified by
// osPathname by calling os.LStat function, to intentionally not follow symbolic
// links.
//
// Even though os.LStat provides all file mode bits, we want to ensure same
// values returned to caller regardless of whether we obtained file mode bits
// from syscall or stat call. Therefore, mask out the additional file mode bits
// that are provided by stat but not by the syscall, so users can rely on their
// values.
func (fs *UnixFS) modeType(dirfd int, name string) (os.FileMode, error) {
	fi, err := fs.Lstatat(dirfd, name)
	if err == nil {
		return fi.Mode() & ModeType, nil
	}
	return 0, err
}

var minimumScratchBufferSize = os.Getpagesize()

func newScratchBuffer() []byte {
	return make([]byte, minimumScratchBufferSize)
}

func (fs *UnixFS) readDir(fd int, name string, b []byte) ([]DirEntry, error) {
	scratchBuffer := b
	if scratchBuffer == nil || len(scratchBuffer) < minimumScratchBufferSize {
		scratchBuffer = newScratchBuffer()
	}

	var entries []DirEntry
	var workBuffer []byte

	var sde unix.Dirent
	for {
		if len(workBuffer) == 0 {
			n, err := unix.Getdents(fd, scratchBuffer)
			if err != nil {
				if err == unix.EINTR {
					continue
				}
				return nil, convertErrorType(err)
			}
			if n <= 0 {
				// end of directory: normal exit
				return entries, nil
			}
			workBuffer = scratchBuffer[:n] // trim work buffer to number of bytes read
		}

		// "Go is like C, except that you just put `unsafe` all over the place".
		copy((*[unsafe.Sizeof(unix.Dirent{})]byte)(unsafe.Pointer(&sde))[:], workBuffer)
		workBuffer = workBuffer[sde.Reclen:] // advance buffer for next iteration through loop

		if sde.Ino == 0 {
			continue // inode set to 0 indicates an entry that was marked as deleted
		}

		nameSlice := nameFromDirent(&sde)
		nameLength := len(nameSlice)

		if nameLength == 0 || (nameSlice[0] == '.' && (nameLength == 1 || (nameLength == 2 && nameSlice[1] == '.'))) {
			continue
		}

		childName := string(nameSlice)
		mt, err := fs.modeTypeFromDirent(fd, &sde, name, childName)
		if err != nil {
			return nil, convertErrorType(err)
		}
		entries = append(entries, &dirent{name: childName, path: name, modeType: mt, dirfd: fd, fs: fs})
	}
}

// dirent stores the name and file system mode type of discovered file system
// entries.
type dirent struct {
	name     string
	path     string
	modeType FileMode

	dirfd int
	fs    *UnixFS
}

func (de dirent) Name() string {
	return de.name
}

func (de dirent) IsDir() bool {
	return de.modeType&ModeDir != 0
}

func (de dirent) Type() FileMode {
	return de.modeType
}

func (de dirent) Info() (FileInfo, error) {
	if de.fs == nil {
		return nil, nil
	}
	return de.fs.Lstatat(de.dirfd, de.name)
}

func (de dirent) Open() (File, error) {
	if de.fs == nil {
		return nil, nil
	}
	return de.fs.OpenFileat(de.dirfd, de.name, O_RDONLY, 0)
}

// reset releases memory held by entry err and name, and resets mode type to 0.
func (de *dirent) reset() {
	de.name = ""
	de.path = ""
	de.modeType = 0
}
//
//	<Property value="testing"/>
//
	"bytes"
	"io"
	"github.com/pterodactyl/wings/internal/ufs"
func (cv *ReplaceValue) Bytes() []byte {
	switch cv.Type() {
	case jsonparser.String:
		var stackbuf [64]byte
		bU, err := jsonparser.Unescape(cv.value, stackbuf[:])
		if err != nil {
			panic(errors.Wrap(err, "parser: could not parse value"))
		}
		return bU
	case jsonparser.Null:
		return []byte("<nil>")
	case jsonparser.Boolean:
		return cv.value
	case jsonparser.Number:
		return cv.value
	default:
		return []byte("<invalid>")
	}
}

// Parse parses a given configuration file and updates all the values within
// as defined in the API response from the Panel.
func (f *ConfigurationFile) Parse(file ufs.File) error {
	//log.WithField("path", path).WithField("parser", f.Parser.String()).Debug("parsing server configuration file")
	// What the fuck is going on here?
		err = f.parsePropertiesFile(file)
		err = f.parseTextFile(file)
		err = f.parseYamlFile(file)
		err = f.parseJsonFile(file)
		err = f.parseIniFile(file)
		err = f.parseXmlFile(file)
func (f *ConfigurationFile) parseXmlFile(file ufs.File) error {
	if _, err := file.Seek(0, io.SeekStart); err != nil {
		return err
	}
	// Write the XML to the file.
	if _, err := doc.WriteTo(file); err != nil {
	return nil
func (f *ConfigurationFile) parseIniFile(file ufs.File) error {
	// Wrap the file in a NopCloser so the ini package doesn't close the file.
	cfg, err := ini.Load(io.NopCloser(file))
	if _, err := file.Seek(0, io.SeekStart); err != nil {
		return err
	}
	if err := file.Truncate(0); err != nil {
		return err
	}

	if _, err := cfg.WriteTo(file); err != nil {
		return err
	}
	return nil
func (f *ConfigurationFile) parseJsonFile(file ufs.File) error {
	b, err := io.ReadAll(file)
	if _, err := file.Seek(0, io.SeekStart); err != nil {
		return err
	}
	if err := file.Truncate(0); err != nil {
		return err
	}

	// Write the data to the file.
	if _, err := io.Copy(file, bytes.NewReader(data.BytesIndent("", "    "))); err != nil {
		return errors.Wrap(err, "parser: failed to write properties file to disk")
	}
	return nil
func (f *ConfigurationFile) parseYamlFile(file ufs.File) error {
	b, err := io.ReadAll(file)
	if _, err := file.Seek(0, io.SeekStart); err != nil {
		return err
	}
	if err := file.Truncate(0); err != nil {
		return err
	}

	// Write the data to the file.
	if _, err := io.Copy(file, bytes.NewReader(marshaled)); err != nil {
		return errors.Wrap(err, "parser: failed to write properties file to disk")
	}
	return nil
func (f *ConfigurationFile) parseTextFile(file ufs.File) error {
	b := bytes.NewBuffer(nil)
	s := bufio.NewScanner(file)
	var replaced bool
	for s.Scan() {
		line := s.Bytes()
		replaced = false
			if !bytes.HasPrefix(line, []byte(replace.Match)) {
			b.Write(replace.ReplaceWith.Bytes())
			replaced = true
		if !replaced {
			b.Write(line)
		}
		b.WriteByte('\n')
	if _, err := file.Seek(0, io.SeekStart); err != nil {
		return err
	}
	if err := file.Truncate(0); err != nil {
	// Write the data to the file.
	if _, err := io.Copy(file, b); err != nil {
		return errors.Wrap(err, "parser: failed to write properties file to disk")
	}
func (f *ConfigurationFile) parsePropertiesFile(file ufs.File) error {
	b, err := io.ReadAll(file)
	if err != nil {
		return err
	}

	s := bytes.NewBuffer(nil)
	scanner := bufio.NewScanner(bytes.NewReader(b))
	// Scan until we hit a line that is not a comment that actually has content
	// on it. Keep appending the comments until that time.
	for scanner.Scan() {
		text := scanner.Bytes()
		if len(text) > 0 && text[0] != '#' {
			break
		s.Write(text)
		s.WriteByte('\n')
	}
	if err := scanner.Err(); err != nil {
		return errors.WithStackIf(err)
	p, err := properties.Load(b, properties.UTF8)
	if _, err := file.Seek(0, io.SeekStart); err != nil {
		return err
	}
	if err := file.Truncate(0); err != nil {
	if _, err := io.Copy(file, s); err != nil {
	if res.ContentLength < 1 {
		return errors.New("downloader: request is missing ContentLength")
	// Write the file while tracking the progress, Write will check that the
	// size of the file won't exceed the disk limit.
	if err := dl.server.Filesystem().Write(p, r, res.ContentLength, 0o644); err != nil {
	// The use of `os` here is safe as backups are not stored within server
	// accessible directories.
	f, st, err := s.Filesystem().File(token.FilePath)
	}
	defer f.Close()
	if st.IsDir() {
		_ = s.Filesystem().UnixFS().Close()
	p := strings.TrimLeft(c.Query("file"), "/")

	if c.Request.ContentLength < 1 {
		c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{
			"error": "Missing Content-Length",
		})
		return
	}

	if err := s.Filesystem().Write(f, c.Request.Body, c.Request.ContentLength, 0o644); err != nil {
		if err := handleFileUpload(filepath.Join(directory, header.Filename), s, header); err != nil {

	if err := s.Filesystem().Write(p, file, header.Size, 0o644); err != nil {
					_ = trnsfr.Server.Filesystem().UnixFS().Close()
	ad, err := b.Generate(s.Context(), s.Filesystem(), ignored)
		// TODO: since this will be called a lot, it may be worth adding an optimized
		// Write with Chtimes method to the UnixFS that is able to re-use the
		// same dirfd and file name.
		if err := s.Filesystem().Write(file, r, info.Size(), info.Mode()); err != nil {
		return s.Filesystem().Chtimes(file, atime, atime)
	"github.com/pterodactyl/wings/server/filesystem"
	Generate(context.Context, *filesystem.Filesystem, string) (*ArchiveDetails, error)
func (b *LocalBackup) Generate(ctx context.Context, fsys *filesystem.Filesystem, ignore string) (*ArchiveDetails, error) {
		Filesystem: fsys,
		Ignore:     ignore,
func (s *S3Backup) Generate(ctx context.Context, fsys *filesystem.Filesystem, ignore string) (*ArchiveDetails, error) {
		Filesystem: fsys,
		Ignore:     ignore,

	"github.com/pterodactyl/wings/internal/ufs"
// UpdateConfigurationFiles updates all the defined configuration files for
			file, err := s.Filesystem().UnixFS().Touch(f.FileName, ufs.O_RDWR|ufs.O_CREATE, 0o644)
				s.Log().WithField("file_name", f.FileName).WithField("error", err).Error("failed to open file for configuration")
			defer file.Close()
			if err := f.Parse(file); err != nil {
			s.Log().WithField("file_name", f.FileName).Debug("finished processing server configuration file")
	"github.com/pterodactyl/wings/internal/ufs"
	// Filesystem to create the archive with.
	Filesystem *Filesystem
	// BaseDirectory .
	BaseDirectory string


	w *TarProgress
//
// THIS IS UNSAFE TO USE IF `dst` IS PROVIDED BY A USER! ONLY USE THIS WITH
// CONTROLLED PATHS!
	// Using os.OpenFile here is expected, as long as `dst` is not a user
	// provided path.
type walkFunc func(dirfd int, name, relative string, d ufs.DirEntry) error

// Stream streams the creation of the archive to the given writer.
	if a.Filesystem == nil {
		return errors.New("filesystem: archive.Filesystem is unset")
	}

	for i, f := range a.Files {
		if !strings.HasPrefix(f, a.Filesystem.Path()) {
		a.Files[i] = strings.TrimPrefix(strings.TrimPrefix(f, a.Filesystem.Path()), "/")
	a.w = NewTarProgress(tw, a.Progress)
	fs := a.Filesystem.unixFS
	var callback walkFunc
		callback = a.callback(func(_ int, _, relative string, _ ufs.DirEntry) error {
			if i.MatchesPath(relative) {
				return ufs.SkipDir
		callback = a.withFilesCallback()
		callback = a.callback()
	dirfd, name, closeFd, err := fs.SafePath(a.BaseDirectory)
	defer closeFd()
	if err != nil {
		return err
	}
	return fs.WalkDirat(dirfd, name, func(dirfd int, name, relative string, d ufs.DirEntry, err error) error {
		if err != nil {
			return err
		}
			return callback(dirfd, name, relative, d)
	})
func (a *Archive) callback(opts ...walkFunc) walkFunc {
	return func(dirfd int, name, relative string, d ufs.DirEntry) error {
		if d.IsDir() {
			if err := opt(dirfd, name, relative, d); err != nil {
		return a.addToArchive(dirfd, name, relative, d)
func (a *Archive) withFilesCallback() walkFunc {
	return a.callback(func(_ int, _, relative string, _ ufs.DirEntry) error {
			if f != relative && !strings.HasPrefix(strings.TrimSuffix(relative, "/")+"/", strings.TrimSuffix(f, "/")+"/") {
			// will be the ufs.SkipDir error.
		return ufs.SkipDir
func (a *Archive) addToArchive(dirfd int, name, relative string, entry ufs.DirEntry) error {
	s, err := entry.Info()
		if errors.Is(err, ufs.ErrNotExist) {
		return errors.WrapIff(err, "failed executing os.Lstat on '%s'", name)
				log.WithField("name", name).WithField("readlink_err", err.Error()).Warn("failed reading symlink for target path; skipping...")
		return errors.WrapIff(err, "failed to get tar#FileInfoHeader for '%s'", name)
		header.Name = relative
	if err := a.w.WriteHeader(header); err != nil {
		return errors.WrapIff(err, "failed to write tar#FileInfoHeader for '%s'", name)
	f, err := a.Filesystem.unixFS.OpenFileat(dirfd, name, ufs.O_RDONLY, 0)
	if _, err := io.CopyBuffer(a.w, io.LimitReader(f, header.Size), buf); err != nil {
			_ = fs.TruncateRootDirectory()
			r := strings.NewReader("hello, world!\n")
			err := fs.Write("test/file.txt", r, r.Size(), 0o644)
			r = strings.NewReader("hello, world!\n")
			err = fs.Write("test2/file.txt", r, r.Size(), 0o644)
			r = strings.NewReader("hello, world!\n")
			err = fs.Write("test_file.txt", r, r.Size(), 0o644)
			r = strings.NewReader("hello, world!\n")
			err = fs.Write("test_file.txt.old", r, r.Size(), 0o644)
				Filesystem: fs,
					"test",
					"test_file.txt",

	"github.com/klauspost/compress/zip"

	"github.com/pterodactyl/wings/internal/ufs"
func (fs *Filesystem) CompressFiles(dir string, paths []string) (ufs.FileInfo, error) {
	a := &Archive{Filesystem: fs, BaseDirectory: dir, Files: paths}
	d := path.Join(
		dir,
		fmt.Sprintf("archive-%s.tar.gz", strings.ReplaceAll(time.Now().Format(time.RFC3339), ":", "")),
	)
	f, err := fs.unixFS.OpenFile(d, ufs.O_WRONLY|ufs.O_CREATE, 0o644)
	defer f.Close()
	cw := ufs.NewCountedWriter(f)
	if err := a.Stream(context.Background(), cw); err != nil {
		return nil, err
	if !fs.unixFS.CanFit(cw.BytesWritten()) {
		_ = fs.unixFS.Remove(d)
		return nil, newFilesystemError(ErrCodeDiskSpace, nil)
	}
	fs.unixFS.Add(cw.BytesWritten())
	return f.Stat()
}
func (fs *Filesystem) archiverFileSystem(ctx context.Context, p string) (iofs.FS, error) {
	f, err := fs.unixFS.Open(p)
	// Do not use defer to close `f`, it will likely be used later.
	format, _, err := archiver.Identify(filepath.Base(p), f)
	if err != nil && !errors.Is(err, archiver.ErrNoMatch) {
		_ = f.Close()
	// Reset the file reader.
	if _, err := f.Seek(0, io.SeekStart); err != nil {
		_ = f.Close()
	info, err := f.Stat()
	if err != nil {
		_ = f.Close()
	if format != nil {
		switch ff := format.(type) {
		case archiver.Zip:
			// zip.Reader is more performant than ArchiveFS, because zip.Reader caches content information
			// and zip.Reader can open several content files concurrently because of io.ReaderAt requirement
			// while ArchiveFS can't.
			// zip.Reader doesn't suffer from issue #330 and #310 according to local test (but they should be fixed anyway)
			return zip.NewReader(f, info.Size())
		case archiver.Archival:
			return archiver.ArchiveFS{Stream: io.NewSectionReader(f, 0, info.Size()), Format: ff, Context: ctx}, nil
		}
	}
	_ = f.Close()
	return nil, nil
	fsys, err := fs.archiverFileSystem(ctx, filepath.Join(dir, file))
	var size atomic.Int64
			if !fs.unixFS.CanFit(size.Add(info.Size())) {
	f, err := fs.unixFS.Open(filepath.Join(dir, file))
	ex, ok := opts.Format.(archiver.Extractor)
	if !ok {
		return nil
	return ex.Extract(ctx, opts.Reader, nil, func(ctx context.Context, f archiver.File) error {
		if f.IsDir() {
			return nil
		}
		p := filepath.Join(opts.Directory, f.NameInArchive)
		// If it is ignored, just don't do anything with the file and skip over it.
		if err := fs.IsIgnored(p); err != nil {
			return nil
		}
		r, err := f.Open()
		if err != nil {
			return err
		}
		defer r.Close()
		if err := fs.Write(p, r, f.Size(), f.Mode()); err != nil {
			return wrapError(err, opts.FileName)
		}
		// Update the file modification time to the one set in the archive.
		if err := fs.Chtimes(p, f.ModTime(), f.ModTime()); err != nil {
			return wrapError(err, opts.FileName)
		}
		return nil
	})
//
//
			_ = fs.TruncateRootDirectory()

	"github.com/pterodactyl/wings/internal/ufs"
// TODO: can this be replaced with some sort of atomic? Like atomic.Pointer?
// Set sets the last time that a disk space lookup was performed.
// MaxDisk returns the maximum amount of disk space that this Filesystem
// instance is allowed to use.
	return fs.unixFS.Limit()
// SetDiskLimit sets the disk space limit for this Filesystem instance.
	fs.unixFS.SetLimit(i)
		log.WithField("root", fs.Path()).WithField("error", err).Warn("failed to determine root fs directory size")
	return fs.unixFS.Usage()
					log.WithField("root", fs.Path()).WithField("error", err).Warn("failed to update fs disk usage from within routine")
	return fs.unixFS.Usage(), nil
	fs.unixFS.SetUsage(size)
// DirectorySize calculates the size of a directory and its descendants.
func (fs *Filesystem) DirectorySize(root string) (int64, error) {
	dirfd, name, closeFd, err := fs.unixFS.SafePath(root)
	defer closeFd()
	var size atomic.Int64
	err = fs.unixFS.WalkDirat(dirfd, name, func(dirfd int, name, _ string, d ufs.DirEntry, err error) error {
		if err != nil {
			return errors.Wrap(err, "walkdirat err")
		}
		// Only calculate the size of regular files.
		if !d.Type().IsRegular() {
		}
		info, err := fs.unixFS.Lstatat(dirfd, name)
		if err != nil {
			return errors.Wrap(err, "lstatat err")
		}

		// TODO: detect if info is a hard-link and de-duplicate it.
		// ref; https://github.com/pterodactyl/wings/pull/181/files

		size.Add(info.Size())
		return nil
	})
	return size.Load(), errors.WrapIf(err, "server/filesystem: directorysize: failed to walk directory")
	if !fs.unixFS.CanFit(size) {
	return fs.unixFS.Add(i)

	"github.com/pterodactyl/wings/internal/ufs"
	return log.WithField("subsystem", "filesystem").WithField("root", fs.Path()).WithField("error", err)
// for the remainder of the directory. This is assuming an FileInfo struct was even returned.
func (fs *Filesystem) handleWalkerError(err error, f ufs.FileInfo) error {
	"fmt"
	"slices"
	"github.com/apex/log"
	"github.com/pterodactyl/wings/internal/ufs"
// TODO: detect and enable
var useOpenat2 = true

	unixFS *ufs.Quota

	lookupInProgress  atomic.Bool
func New(root string, size int64, denylist []string) (*Filesystem, error) {
	if err := os.MkdirAll(root, 0o755); err != nil {
		return nil, err
	}
	unixFS, err := ufs.NewUnixFS(root, config.UseOpenat2())
	if err != nil {
		return nil, err
	}
	quota := ufs.NewQuota(unixFS, size)

		unixFS: quota,

	}, nil
	return fs.unixFS.BasePath()
}

// ReadDir reads directory entries.
func (fs *Filesystem) ReadDir(path string) ([]ufs.DirEntry, error) {
	return fs.unixFS.ReadDir(path)
}

// ReadDirStat is like ReadDir except that it returns FileInfo for each entry
// instead of just a DirEntry.
func (fs *Filesystem) ReadDirStat(path string) ([]ufs.FileInfo, error) {
	return ufs.ReadDirMap(fs.unixFS.UnixFS, path, func(e ufs.DirEntry) (ufs.FileInfo, error) {
		return e.Info()
	})
func (fs *Filesystem) File(p string) (ufs.File, Stat, error) {
	f, err := fs.unixFS.Open(p)
		return nil, Stat{}, err
	st, err := statFromFile(f)
		_ = f.Close()
		return nil, Stat{}, err
func (fs *Filesystem) UnixFS() *ufs.UnixFS {
	return fs.unixFS.UnixFS
}

func (fs *Filesystem) Touch(p string, flag int) (ufs.File, error) {
	return fs.unixFS.Touch(p, flag, 0o644)
//
// DEPRECATED: use `Write` instead.
	var currentSize int64
	st, err := fs.unixFS.Stat(p)
	if err != nil && !errors.Is(err, ufs.ErrNotExist) {
		return errors.Wrap(err, "server/filesystem: writefile: failed to stat file")
	} else if err == nil {
		if st.IsDir() {
			// TODO: resolved
			return errors.WithStack(&Error{code: ErrCodeIsDirectory, resolved: ""})
		}
		currentSize = st.Size()
	}

	// Touch the file and return the handle to it at this point. This will
	// create or truncate the file, and create any necessary parent directories
	// if they are missing.
	file, err := fs.unixFS.Touch(p, ufs.O_RDWR|ufs.O_TRUNC, 0o644)
		return fmt.Errorf("error touching file: %w", err)
	defer file.Close()
	// Do not use CopyBuffer here, it is wasteful as the file implements
	// io.ReaderFrom, which causes it to not use the buffer anyways.
	n, err := io.Copy(file, r)

	// Adjust the disk usage to account for the old size and the new size of the file.
	fs.unixFS.Add(n - currentSize)

	if err := fs.chownFile(p); err != nil {
		return fmt.Errorf("error chowning file: %w", err)
	}
	// Return the error from io.Copy.
	return err
}

func (fs *Filesystem) Write(p string, r io.Reader, newSize int64, mode ufs.FileMode) error {
	st, err := fs.unixFS.Stat(p)
	if err != nil && !errors.Is(err, ufs.ErrNotExist) {
		if st.IsDir() {
			// TODO: resolved
			return errors.WithStack(&Error{code: ErrCodeIsDirectory, resolved: ""})
		currentSize = st.Size()
	if err := fs.HasSpaceFor(newSize - currentSize); err != nil {
	// Touch the file and return the handle to it at this point. This will
	// create or truncate the file, and create any necessary parent directories
	// if they are missing.
	file, err := fs.unixFS.Touch(p, ufs.O_RDWR|ufs.O_TRUNC, mode)
	// Do not use CopyBuffer here, it is wasteful as the file implements
	// io.ReaderFrom, which causes it to not use the buffer anyways.
	n, err := io.Copy(file, io.LimitReader(r, newSize))
	fs.unixFS.Add(n - currentSize)
	if err := fs.chownFile(p); err != nil {
	// Return the error from io.Copy.
	return err
// CreateDirectory creates a new directory (name) at a specified path (p) for
// the server.
func (fs *Filesystem) CreateDirectory(name string, p string) error {
	return fs.unixFS.MkdirAll(filepath.Join(p, name), 0o755)
}
func (fs *Filesystem) Rename(oldpath, newpath string) error {
	return fs.unixFS.Rename(oldpath, newpath)
}
func (fs *Filesystem) Symlink(oldpath, newpath string) error {
	return fs.unixFS.Symlink(oldpath, newpath)
}
func (fs *Filesystem) chownFile(name string) error {
	if fs.isTest {
		return nil
	uid := config.Get().System.User.Uid
	gid := config.Get().System.User.Gid
	return fs.unixFS.Lchown(name, uid, gid)
// Chown recursively iterates over a file or directory and sets the permissions on all of the
func (fs *Filesystem) Chown(p string) error {
	dirfd, name, closeFd, err := fs.unixFS.SafePath(p)
	defer closeFd()
	if err != nil {
		return err
	}

	if err := fs.unixFS.Lchownat(dirfd, name, uid, gid); err != nil {
	if st, err := fs.unixFS.Lstatat(dirfd, name); err != nil || !st.IsDir() {
	// This walker is probably some of the most efficient code in Wings. It has
	// an internally re-used buffer for listing directory entries and doesn't
	// need to check if every individual path it touches is safe as the code
	// doesn't traverse symlinks, is immune to symlink timing attacks, and
	// gives us a dirfd and file name to make a direct syscall with.
	if err := fs.unixFS.WalkDirat(dirfd, name, func(dirfd int, name, _ string, info ufs.DirEntry, err error) error {
		if err != nil {
			return err
		}
		if err := fs.unixFS.Lchownat(dirfd, name, uid, gid); err != nil {
			return err
		}
	}); err != nil {
		return fmt.Errorf("server/filesystem: chown: failed to chown during walk function: %w", err)
func (fs *Filesystem) Chmod(path string, mode ufs.FileMode) error {
	return fs.unixFS.Chmod(path, mode)
}

func (fs *Filesystem) findCopySuffix(dirfd int, name, extension string) (string, error) {
		if _, err := fs.unixFS.Lstatat(dirfd, n); err != nil {
			if !errors.Is(err, ufs.ErrNotExist) {
// Copy copies a given file to the same location and appends a suffix to the
// file to indicate that it has been copied.
	dirfd, name, closeFd, err := fs.unixFS.SafePath(p)
	defer closeFd()
	source, err := fs.unixFS.OpenFileat(dirfd, name, ufs.O_RDONLY, 0)
	}
	defer source.Close()
	info, err := source.Stat()
	if err != nil {
		return err
	}
	if info.IsDir() || !info.Mode().IsRegular() {
		return ufs.ErrNotExist
	currentSize := info.Size()
	if err := fs.HasSpaceFor(currentSize); err != nil {
	base := info.Name()
	baseName := strings.TrimSuffix(base, extension)
	if strings.HasSuffix(baseName, ".tar") {
		baseName = strings.TrimSuffix(baseName, ".tar")
	newName, err := fs.findCopySuffix(dirfd, baseName, extension)
	dst, err := fs.unixFS.OpenFileat(dirfd, newName, ufs.O_WRONLY|ufs.O_CREATE, info.Mode())
	// Do not use CopyBuffer here, it is wasteful as the file implements
	// io.ReaderFrom, which causes it to not use the buffer anyways.
	n, err := io.Copy(dst, io.LimitReader(source, currentSize))
	fs.unixFS.Add(n)

	if !fs.isTest {
		if err := fs.unixFS.Lchownat(dirfd, newName, config.Get().System.User.Uid, config.Get().System.User.Gid); err != nil {
			return err
		}
	}
	// Return the error from io.Copy.
	return err
	_ = fs.unixFS.Close()
	unixFS, err := ufs.NewUnixFS(fs.Path(), config.UseOpenat2())
	if err != nil {
		return err
	}
	var limit int64
	if fs.isTest {
		limit = 0
	} else {
		limit = fs.unixFS.Limit()
	}
	fs.unixFS = ufs.NewQuota(unixFS, limit)
	return fs.unixFS.RemoveAll(p)
}
//type fileOpener struct {
//	fs   *Filesystem
//	busy uint
//}
//
//// Attempts to open a given file up to "attempts" number of times, using a backoff. If the file
//// cannot be opened because of a "text file busy" error, we will attempt until the number of attempts
//// has been exhaused, at which point we will abort with an error.
//func (fo *fileOpener) open(path string, flags int, perm ufs.FileMode) (ufs.File, error) {
//	for {
//		f, err := fo.fs.unixFS.OpenFile(path, flags, perm)
//
//		// If there is an error because the text file is busy, go ahead and sleep for a few
//		// hundred milliseconds and then try again up to three times before just returning the
//		// error back to the caller.
//		//
//		// Based on code from: https://github.com/golang/go/issues/22220#issuecomment-336458122
//		if err != nil && fo.busy < 3 && strings.Contains(err.Error(), "text file busy") {
//			time.Sleep(100 * time.Millisecond << fo.busy)
//			fo.busy++
//			continue
//		}
//
//		return f, err
//	}
//}
// ListDirectory lists the contents of a given directory and returns stat
// information about each file and folder within it.
func (fs *Filesystem) ListDirectory(p string) ([]Stat, error) {
	// Read entries from the path on the filesystem, using the mapped reader, so
	// we can map the DirEntry slice into a Stat slice with mimetype information.
	out, err := ufs.ReadDirMap(fs.unixFS.UnixFS, p, func(e ufs.DirEntry) (Stat, error) {
		info, err := e.Info()
			return Stat{}, err
		var d string
		if e.Type().IsDir() {
			d = "inode/directory"
		} else {
			d = "application/octet-stream"
		var m *mimetype.MIME
		if e.Type().IsRegular() {
			// TODO: I should probably find a better way to do this.
			eO := e.(interface {
				Open() (ufs.File, error)
			})
			f, err := eO.Open()
			if err != nil {
				return Stat{}, err
			}
			m, err = mimetype.DetectReader(f)
			if err != nil {
				log.Error(err.Error())
			}
			_ = f.Close()
		st := Stat{FileInfo: info, Mimetype: d}
		if m != nil {
			st.Mimetype = m.String()
		}
		return st, nil
	})
	// Sort entries alphabetically.
	slices.SortStableFunc(out, func(a, b Stat) int {
		switch {
		case a.Name() == b.Name():
			return 0
		case a.Name() > b.Name():
			return 1
		default:
			return -1
	// Sort folders before other file types.
	slices.SortStableFunc(out, func(a, b Stat) int {
		switch {
		case a.IsDir() && b.IsDir():
			return 0
		case a.IsDir():
			return 1
		default:
			return -1
		}
	return fs.unixFS.Chtimes(path, atime, mtime)
	"github.com/pterodactyl/wings/internal/ufs"

		return nil, nil
	p := filepath.Join(tmpDir, "server")
	if err := os.Mkdir(p, 0o755); err != nil {
		panic(err)
		return nil, nil
	}
	fs, _ := New(p, 0, []string{})
	if err := fs.TruncateRootDirectory(); err != nil {
		panic(err)
		return nil, nil
	}
func getFileContent(file ufs.File) string {
	f, err := os.Create(filepath.Join(rfs.root, "server", p))
		_, _ = f.Write(c)
		_ = f.Close()
	return os.Stat(filepath.Join(rfs.root, "server", p))
			// TODO
			//g.Assert(IsErrorCode(err, ErrNotExist)).IsTrue()
			_ = fs.TruncateRootDirectory()
	fs, _ := NewFs()
			g.Assert(fs.CachedUsage()).Equal(int64(0))
			err := fs.Write("test.txt", r, r.Size(), 0o644)
			g.Assert(fs.CachedUsage()).Equal(r.Size())
			err := fs.Write("/some/nested/test.txt", r, r.Size(), 0o644)
			err := fs.Write("some/../foo/bar/test.txt", r, r.Size(), 0o644)
			err := fs.Write("/some/../foo/../../test.txt", r, r.Size(), 0o644)
			g.Assert(errors.Is(err, ufs.ErrBadPathResolution)).IsTrue("err is not ErrBadPathResolution")
			fs.SetDiskLimit(1024)
			err = fs.Write("test.txt", r, int64(len(b)), 0o644)
			err := fs.Write("test.txt", r, r.Size(), 0o644)
			err = fs.Write("test.txt", r, r.Size(), 0o644)
			_ = fs.TruncateRootDirectory()
			g.Assert(errors.Is(err, ufs.ErrBadPathResolution)).IsTrue("err is not ErrBadPathResolution")
			g.Assert(fs.CachedUsage()).Equal(int64(0))
			_ = fs.TruncateRootDirectory()
			g.Assert(errors.Is(err, ufs.ErrExist)).IsTrue("err is not ErrExist")
			g.Assert(errors.Is(err, ufs.ErrBadPathResolution)).IsTrue("err is not ErrBadPathResolution")
			err := fs.Rename("/", "target.txt")
			g.Assert(errors.Is(err, ufs.ErrBadPathResolution)).IsTrue("err is not ErrBadPathResolution")
			g.Assert(errors.Is(err, ufs.ErrBadPathResolution)).IsTrue("err is not ErrBadPathResolution")
			g.Assert(errors.Is(err, ufs.ErrBadPathResolution)).IsTrue("err is not ErrBadPathResolution")
			g.Assert(errors.Is(err, ufs.ErrNotExist)).IsTrue("err is not ErrNotExist")
			g.Assert(errors.Is(err, ufs.ErrNotExist)).IsTrue("err is not ErrNotExist")
			g.Assert(errors.Is(err, ufs.ErrNotExist)).IsTrue("err is not ErrNotExist")
			_ = fs.TruncateRootDirectory()
			fs.unixFS.SetUsage(int64(utf8.RuneCountInString("test content")))
			g.Assert(errors.Is(err, ufs.ErrNotExist)).IsTrue("err is not ErrNotExist")
			g.Assert(errors.Is(err, ufs.ErrBadPathResolution)).IsTrue("err is not ErrBadPathResolution")
			err := os.MkdirAll(filepath.Join(rfs.root, "nested/in/dir"), 0o755)
			g.Assert(errors.Is(err, ufs.ErrBadPathResolution)).IsTrue("err is not ErrBadPathResolution")
			g.Assert(errors.Is(err, ufs.ErrBadPathResolution)).IsTrue("err is not ErrBadPathResolution")
			err := os.Mkdir(filepath.Join(rfs.root, "server/dir"), 0o755)
			g.Assert(errors.Is(err, ufs.ErrNotExist)).IsTrue("err is not ErrNotExist")
			fs.SetDiskLimit(2)
			g.Assert(IsErrorCode(err, ErrCodeDiskSpace)).IsTrue("err is not ErrCodeDiskSpace")
			g.Assert(fs.CachedUsage()).Equal(int64(utf8.RuneCountInString("test content")) * 3)
			_ = fs.TruncateRootDirectory()
			fs.unixFS.SetUsage(int64(utf8.RuneCountInString("test content")))
			g.Assert(errors.Is(err, ufs.ErrBadPathResolution)).IsTrue("err is not ErrBadPathResolution")
			g.Assert(errors.Is(err, ufs.ErrBadPathResolution)).IsTrue("err is not ErrBadPathResolution")
			g.Assert(errors.Is(err, ufs.ErrNotExist)).IsTrue("err is not ErrNotExist")
			g.Assert(fs.CachedUsage()).Equal(int64(0))
			fs.unixFS.SetUsage(int64(utf8.RuneCountInString("test content") * 3))
			g.Assert(fs.unixFS.Usage()).Equal(int64(0))
				g.Assert(errors.Is(err, ufs.ErrNotExist)).IsTrue("err is not ErrNotExist")
			g.Assert(errors.Is(err, ufs.ErrBadPathResolution)).IsTrue("err is not ErrBadPathResolution")
			g.Assert(errors.Is(err, ufs.ErrBadPathResolution)).IsTrue("err is not ErrBadPathResolution")
			_ = fs.TruncateRootDirectory()
		//sp, err := fs.SafePath(p)
		//if err != nil {
		//	return err
		//}
		// TODO: update logic to use unixFS
		if fs.denylist.MatchesPath(p) {
			return errors.WithStack(&Error{code: ErrCodeDenylistFile, path: p, resolved: p})

	"github.com/pterodactyl/wings/internal/ufs"
			g.Assert(errors.Is(err, ufs.ErrBadPathResolution)).IsTrue("err is not ErrBadPathResolution")
			g.Assert(errors.Is(err, ufs.ErrBadPathResolution)).IsTrue("err is not ErrBadPathResolution")
			g.Assert(errors.Is(err, ufs.ErrBadPathResolution)).IsTrue("err is not ErrBadPathResolution")
			g.Assert(errors.Is(err, ufs.ErrNotDirectory)).IsTrue("err is not ErrNotDirectory")
			g.Assert(errors.Is(err, ufs.ErrNotDirectory)).IsTrue("err is not ErrNotDirectory")
			g.Assert(errors.Is(err, ufs.ErrNotDirectory)).IsTrue("err is not ErrNotDirectory")
			g.Assert(errors.Is(err, ufs.ErrNotDirectory)).IsTrue("err is not ErrNotDirectory")
		g.It("can rename a file symlinked outside the directory root", func() {
			_, err := os.Lstat(filepath.Join(rfs.root, "server", "symlinked.txt"))
			g.Assert(err).IsNil()
			err = fs.Rename("symlinked.txt", "foo.txt")
			g.Assert(err).IsNil()
			_, err = os.Lstat(filepath.Join(rfs.root, "server", "foo.txt"))
			g.Assert(err).IsNil()
		g.It("can rename a symlinked directory outside the root", func() {
			_, err := os.Lstat(filepath.Join(rfs.root, "server", "external_dir"))
			g.Assert(err).IsNil()
			err = fs.Rename("external_dir", "foo")
			g.Assert(err).IsNil()
			_, err = os.Lstat(filepath.Join(rfs.root, "server", "foo"))
			g.Assert(err).IsNil()
			_ = rfs.CreateServerFileFromString("my_file.txt", "internal content")
			t.Log(rfs.root)
			st, err := os.Lstat(filepath.Join(rfs.root, "server", "foo"))
			g.Assert(err).IsNil()
			g.Assert(st.Mode()&ufs.ModeSymlink != 0).IsTrue()
			err = fs.Rename("my_file.txt", "foo/my_file.txt")
			g.Assert(errors.Is(err, ufs.ErrNotDirectory)).IsTrue()
			st, err = os.Lstat(filepath.Join(rfs.root, "malicious_dir", "my_file.txt"))
			g.Assert(errors.Is(err, ufs.ErrNotExist)).IsTrue()
			g.Assert(errors.Is(err, ufs.ErrNotExist)).IsTrue("err is not ErrNotExist")
			g.Assert(errors.Is(err, ufs.ErrNotExist)).IsTrue("err is not ErrNotExist")
	_ = fs.TruncateRootDirectory()
	"encoding/json"
	"io"

	"github.com/pterodactyl/wings/internal/ufs"
	ufs.FileInfo
		// Using `&ModePerm` on the file's mode will cause the mode to only have the permission values, and nothing else.
		ModeBits:  strconv.FormatUint(uint64(s.Mode()&ufs.ModePerm), 8),
		Symlink:   s.Mode().Perm()&ufs.ModeSymlink != 0,
func statFromFile(f ufs.File) (Stat, error) {
	s, err := f.Stat()
		m, err = mimetype.DetectReader(f)
		if _, err := f.Seek(0, io.SeekStart); err != nil {
			return Stat{}, err
		}
	return st, nil
}
// Stat stats a file or folder and returns the base stat object from go along
// with the MIME data that can be used for editing files.
func (fs *Filesystem) Stat(p string) (Stat, error) {
	f, err := fs.unixFS.Open(p)
	if err != nil {
		return Stat{}, err
	}
	defer f.Close()
	st, err := statFromFile(f)
	if err != nil {
		return Stat{}, err
	}

	"golang.org/x/sys/unix"
// CTime returns the time that the file/folder was created.
//
// TODO: remove. Ctim is not actually ever been correct and doesn't actually
// return the creation time.
	if st, ok := s.Sys().(*unix.Stat_t); ok {
		// Do not remove these "redundant" type-casts, they are required for 32-bit builds to work.
		return time.Unix(int64(st.Ctim.Sec), int64(st.Ctim.Nsec))
	}
	if st, ok := s.Sys().(*syscall.Stat_t); ok {
		// Do not remove these "redundant" type-casts, they are required for 32-bit builds to work.
		return time.Unix(int64(st.Ctim.Sec), int64(st.Ctim.Nsec))
	}
	return time.Time{}
	// os.TempDir call expects this base to exist, it won't create it for you.
	if _, err := io.Copy(f, strings.NewReader(strings.ReplaceAll(ip.Script.Script, "\r\n", "\n"))); err != nil {
	s.fs, err = filesystem.New(filepath.Join(config.Get().System.Data, s.ID()), s.DiskSpace(), s.Config().Egg.FileDenylist)
	if err != nil {
		return nil, errors.WithStackIf(err)
	}
			Filesystem: t.Server.Filesystem(),
			Progress:   progress.NewProgress(size),
	f, err := h.fs.Touch(request.Filepath, os.O_RDWR|os.O_TRUNC)
		if err := h.fs.Symlink(request.Filepath, request.Target); err != nil {
			l.WithField("target", request.Target).WithField("error", err).Error("failed to create symlink")
		entries, err := h.fs.ReadDirStat(request.Filepath)
		return ListerAt(entries), nil