diff options
Diffstat (limited to 'internal/plan/chain.go')
| -rw-r--r-- | internal/plan/chain.go | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/internal/plan/chain.go b/internal/plan/chain.go index e504504..fda8730 100644 --- a/internal/plan/chain.go +++ b/internal/plan/chain.go @@ -159,6 +159,10 @@ func buildOne(root string, in Input, now time.Time, d Disk, claim claimed) Chain step.Skip = `rename produced a name containing "/"` break } + if name == "" || name == "." || name == ".." { + step.Skip = fmt.Sprintf("rename produced the name %q", name) + break + } dst := filepath.Join(filepath.Dir(cur), name) resolved, skip, displaces := resolveConflict(kind, rule.Settings.OnConflict, cur, dst, d, claim) step.Dst = resolved @@ -207,14 +211,32 @@ func stepKind(k config.ActionKind) Kind { // expandDir expands raw (a DEST argument) against facts, then resolves it // the same way the engine resolves an extra directory: ~ expands, a // relative path joins root, and the result is cleaned. +// +// A placeholder may not add a ".." segment (spec ยง15.1): a capture is part +// of a file name, which can be "..", and must not move the destination out +// of the directory the rule names. A ".." written in the rule itself stands. func expandDir(raw string, facts Facts, root string) (string, error) { expanded, err := Expand(raw, facts) if err != nil { return "", err } + if dotDots(expanded) > dotDots(raw) { + return "", fmt.Errorf("destination %q leaves its directory through a placeholder", expanded) + } return ResolveDir(expanded, root), nil } +// dotDots counts the ".." segments of a slash-separated path. +func dotDots(p string) int { + n := 0 + for _, seg := range strings.Split(p, "/") { + if seg == ".." { + n++ + } + } + return n +} + // ResolveDir expands a leading ~ and joins a relative directory to root, // cleaned. C1: this is the one place that decides where a rule's // destination resolves to; internal/engine calls it too (its own directory |