plan 8: placeholders cannot rename to dot names or climb out with ..

1 files changed, 22 insertions, 0 deletions

diff --git a/internal/plan/chain.go b/internal/plan/chain.go
index e504504..fda8730 100644
--- a/internal/plan/chain.go
+++ b/internal/plan/chain.go
@@ -159,6 +159,10 @@ func buildOne(root string, in Input, now time.Time, d Disk, claim claimed) Chain
 					step.Skip = `rename produced a name containing "/"`
 					break
 				}
+				if name == "" || name == "." || name == ".." {
+					step.Skip = fmt.Sprintf("rename produced the name %q", name)
+					break
+				}
 				dst := filepath.Join(filepath.Dir(cur), name)
 				resolved, skip, displaces := resolveConflict(kind, rule.Settings.OnConflict, cur, dst, d, claim)
 				step.Dst = resolved
@@ -207,14 +211,32 @@ func stepKind(k config.ActionKind) Kind {
 // expandDir expands raw (a DEST argument) against facts, then resolves it
 // the same way the engine resolves an extra directory: ~ expands, a
 // relative path joins root, and the result is cleaned.
+//
+// A placeholder may not add a ".." segment (spec §15.1): a capture is part
+// of a file name, which can be "..", and must not move the destination out
+// of the directory the rule names. A ".." written in the rule itself stands.
 func expandDir(raw string, facts Facts, root string) (string, error) {
 	expanded, err := Expand(raw, facts)
 	if err != nil {
 		return "", err
 	}
+	if dotDots(expanded) > dotDots(raw) {
+		return "", fmt.Errorf("destination %q leaves its directory through a placeholder", expanded)
+	}
 	return ResolveDir(expanded, root), nil
 }
 
+// dotDots counts the ".." segments of a slash-separated path.
+func dotDots(p string) int {
+	n := 0
+	for _, seg := range strings.Split(p, "/") {
+		if seg == ".." {
+			n++
+		}
+	}
+	return n
+}
+
 // ResolveDir expands a leading ~ and joins a relative directory to root,
 // cleaned. C1: this is the one place that decides where a rule's
 // destination resolves to; internal/engine calls it too (its own directory