WP_REST_Attachments_Controller::get_attachment_upload_subdir( string $attached_file ): string|null

3204	protected function get_attachment_upload_subdir( string $attached_file ): ?string {3205		$uploads = wp_get_upload_dir();3206		if ( empty( $uploads['basedir'] ) ) {3207			return null;3208		}3209 3210		$basedir  = untrailingslashit( wp_normalize_path( $uploads['basedir'] ) );3211		$file_dir = wp_normalize_path( dirname( $attached_file ) );3212 3213		/*3214		 * The attachment's directory must be the uploads base directory itself3215		 * or a directory inside it. The trailing slash in the prefix comparison3216		 * keeps a sibling directory that merely shares the prefix (for example3217		 * 'uploads-elsewhere' next to 'uploads') from matching.3218		 */3219		if ( $file_dir !== $basedir && ! str_starts_with( $file_dir, trailingslashit( $basedir ) ) ) {3220			return null;3221		}3222 3223		$subdir = (string) substr( $file_dir, strlen( $basedir ) );3224 3225		// A prefix match alone does not rule out a path that climbs back out.3226		if ( in_array( '..', explode( '/', $subdir ), true ) ) {3227			return null;3228		}3229 3230		return $subdir;3231	}