Commit 258eacb

committed

Use paths.SafeNew when dealing with external sources

1 parent 4b3d731 commit 258eacbCopy full SHA for 258eacb

File tree

+33

-10

lines changed

+33

-10

lines changed

Lines changed: 5 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -33,7 +33,11 @@ func (r DownloadResource) ArchivePath(downloadDir paths.Path) (*paths.Path, er`
`33`	`33`	`}`
`34`	`34`
`35`	`35`	`// Filter out paths from file name`
`36`		`- archiveFileName := paths.New(r.ArchiveFileName).Base()`
	`36`	`+ archiveFile, err := paths.SafeNew(r.ArchiveFileName)`
	`37`	`+ if err != nil {`
	`38`	`+ return nil, errors.Errorf("invalid filename: %s", r.ArchiveFileName)`
	`39`	`+ }`
	`40`	`+ archiveFileName := archiveFile.Base()`
`37`	`41`	`archivePath := staging.Join(archiveFileName).Clean()`
`38`	`42`	`if archivePath.IsDir() {`
`39`	`43`	`return nil, errors.Errorf("invalid filename or exinsting directory: %s", archivePath)`

Lines changed: 25 additions & 8 deletions

Original file line number	Diff line number	Diff line change
`@@ -46,9 +46,11 @@ func TestResourcesSanityChecks(t *testing.T) {`
`46`	`46`	`"test.txt",`
`47`	`47`	`"/test.txt",`
`48`	`48`	`"somepath/to/test.txt",`
`49`		`- "/../test.txt",`
`50`		`- "some/../test.txt",`
	`49`	`+ "/somepath/to/test.txt",`
	`50`	`+ "path/to/../test.txt",`
	`51`	`+ "/path/to/../test.txt",`
`51`	`52`	`"../test.txt",`
	`53`	`+ "/../test.txt",`
`52`	`54`	`}`
`53`	`55`	`for _, testArchiveFileName := range testArchiveFileNames {`
`54`	`56`	`r := &DownloadResource{`
`@@ -74,13 +76,28 @@ func TestResourcesSanityChecks(t *testing.T) {`
`74`	`76`	`}`
`75`	`77`
`76`	`78`	`{`
`77`		`- r := &DownloadResource{`
`78`		`- ArchiveFileName: "..",`
`79`		`- CachePath: "cache",`
	`79`	`+ testArchiveFileNames := []string{`
	`80`	`+ "/",`
	`81`	`+ ".",`
	`82`	`+ "/.",`
	`83`	`+ "..",`
	`84`	`+ "/..",`
	`85`	`+ "path/..",`
	`86`	`+ "/path/..",`
	`87`	`+ "path/path/..",`
	`88`	`+ "/path/path/..",`
	`89`	`+ ".." + string([]byte{0xC0, 0xAF}) + "test.txt",`
	`90`	`+ "/.." + string([]byte{0xC0, 0xAF}) + "test.txt",`
	`91`	`+ }`
	`92`	`+ for _, testArchiveFileName := range testArchiveFileNames {`
	`93`	`+ r := &DownloadResource{`
	`94`	`+ ArchiveFileName: testArchiveFileName,`
	`95`	`+ CachePath: "cache",`
	`96`	`+ }`
	`97`	`+ archivePath, err := r.ArchivePath(tmp)`
	`98`	`+ require.Nil(t, archivePath)`
	`99`	`+ require.Error(t, err)`
`80`	`100`	`}`
`81`		`- archivePath, err := r.ArchivePath(tmp)`
`82`		`- require.Error(t, err)`
`83`		`- require.Nil(t, archivePath)`
`84`	`101`	`}`
`85`	`102`	`}`
`86`	`103`

Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -9,7 +9,7 @@ require (`
`9`	`9`	`bou.ke/monkey v1.0.1`
`10`	`10`	`github.com/GeertJohan/go.rice v1.0.0`
`11`	`11`	`github.com/arduino/board-discovery v0.0.0-20180823133458-1ba29327fb0c`
`12`		`- github.com/arduino/go-paths-helper v1.2.0`
	`12`	`+ github.com/arduino/go-paths-helper v1.2.1-0.20200802112116-33dcc69b14ba`
`13`	`13`	`github.com/arduino/go-properties-orderedmap v1.3.0`
`14`	`14`	`github.com/arduino/go-timeutils v0.0.0-20171220113728-d1dd9e313b1b`
`15`	`15`	`github.com/arduino/go-win32-utils v0.0.0-20180330194947-ed041402e83b`

Lines changed: 2 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -18,6 +18,8 @@ github.com/arduino/go-paths-helper v1.0.1 h1:utYXLM2RfFlc9qp/MJTIYp3t6ux/xM6mWje`
`18`	`18`	`github.com/arduino/go-paths-helper v1.0.1/go.mod h1:HpxtKph+g238EJHq4geEPv9p+gl3v5YYu35Yb+w31Ck=`
`19`	`19`	`github.com/arduino/go-paths-helper v1.2.0 h1:qDW93PR5IZUN/jzO4rCtexiwF8P4OIcOmcSgAYLZfY4=`
`20`	`20`	`github.com/arduino/go-paths-helper v1.2.0/go.mod h1:HpxtKph+g238EJHq4geEPv9p+gl3v5YYu35Yb+w31Ck=`
	`21`	`+github.com/arduino/go-paths-helper v1.2.1-0.20200802112116-33dcc69b14ba h1:rQtLTpIICgc8ad2UG/A7X1F4TpKGoazBxhKR+crsf4k=`
	`22`	`+github.com/arduino/go-paths-helper v1.2.1-0.20200802112116-33dcc69b14ba/go.mod h1:HpxtKph+g238EJHq4geEPv9p+gl3v5YYu35Yb+w31Ck=`
`21`	`23`	`github.com/arduino/go-properties-orderedmap v1.3.0 h1:4No/vQopB36e7WUIk6H6TxiSEJPiMrVOCZylYmua39o=`
`22`	`24`	`github.com/arduino/go-properties-orderedmap v1.3.0/go.mod h1:DKjD2VXY/NZmlingh4lSFMEYCVubfeArCsGPGDwb2yk=`
`23`	`25`	`github.com/arduino/go-timeutils v0.0.0-20171220113728-d1dd9e313b1b h1:9hDi4F2st6dbLC3y4i02zFT5quS4X6iioWifGlVwfy4=`

Comments

(0)