Function resolve_within 

pub fn resolve_within(
    root: &Path,
    rel: &str,
    allow_leaf_symlink: bool,
) -> Result<PathBuf, ContainmentError>

Resolve a declared path against root, refusing to escape it.

The root must not be a symlink, rel must be a plain relative path (see RelPath), and no existing prefix of it may be a symlink. Each prefix is checked with symlink_metadata, so nothing is ever followed. With allow_leaf_symlink the final component may be a symlink: fixtures use that to replace one, and gone-style checks use it to notice a leftover link. Checking stops at the first prefix that does not exist, because nothing below a missing directory can be a symlink.

Ancestors of root are deliberately not inspected.