ExportPaths.h header

bool ew::app::publishing::copyExportAsset(const QString &from, const QString &to)

Copies the export asset \p from to \p to, creating the destination's parent folder, and reports whether the asset is in place afterwards.

The subtlety this exists for: QFile::copy never overwrites, so every caller removed the destination first – and when a site is exported INTO the project folder (an output_dir of ".", or picking the project folder in the desktop's folder dialog) the destination and the source are the same file under two different strings, which no string comparison catches (<project>/./assets/map.png vs <project>/assets/map.png). The remove then deleted the writer's own image and the copy failed for want of a source, while the export still reported success (F-0056). Comparing canonical paths resolves ., .., and symlinks, so the same-file case is detected and left alone – the asset is already exactly where the export wants it.

bool ew::app::publishing::isPackageableAssetPath(const QString &src)

True when src (an image/asset reference lifted from exported HTML or Markdown) is a plain project-relative file path that may safely be resolved against the project folder and then read, copied, or packaged into an export. Returns false for anything that could reach a file outside the project folder, or that is not a local file at all:

• an external URL or data URI – any scheme: prefix (http:, https:, data:, file:, javascript:);
• a Windows drive-absolute path (C:\..., C:/...; also caught as a scheme: colon);
• a POSIX-absolute path (leading /) or a Windows root / UNC path (leading \\endiskip);
• any parent-directory traversal (a .. segment, on either the / or \\endiskip separator). This is the allowlist the website- and EPUB-image collectors apply so a hostile manuscript body such as ![x](C:/Windows/System32/...) or ![x](../../secret) cannot exfiltrate a file into a shared export, nor overwrite or delete a file outside the project when a site or book is written. App-authored asset paths are always of the form assets/<file> (see AssetImport), so no legitimate reference is rejected.