Improper Handling of Apple HFS+ Alternate Data Stream Path

When an application makes security or logic decisions based solely on a file's main path, an attacker can bypass these controls by specifying an alternate stream path instead. For example, a validation check that allows '/safe/file.txt' might also unintentionally allow '/safe/file.txt/..namedfork/data', granting access to the same file through a different channel. This can lead to two primary risks. First, access restrictions can be circumvented if the software doesn't recognize that the alternate stream path refers to the same underlying file. Second, if the application performs different actions based on file extensions or names, feeding it a resource fork path could trigger unexpected and potentially dangerous behavior, as the code is now interacting with a different part of the file than intended.