github/homebrew-cask-versions
2
0
Fork 0
mirror of https://github.com/donl/homebrew-cask-versions.git synced 2026-07-17 14:26:45 -06:00
Code Issues Projects Packages Wiki Activity Actions

Merge pull request #6193 from rolandwalker/double_dot_is_relative

Browse source 
protect against inner ".." in uninstall paths
This commit is contained in:
Roland Walker 2014-09-16 07:08:35 -04:00
commit feca527e78
2 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
lib/cask/artifact/uninstall_base.rb
View file

@ -15,9 +15,9 @@ class Cask::Artifact::UninstallBase < Cask::Artifact::Base
end
def self.remove_relative_path_strings(action, path_strings)
relative = path_strings.reject do |path_string|
%r{\A/}.match(path_string)
end
relative = path_strings.map do |path_string|
path_string if %r{/\.\.(?:/|\Z)}.match(path_string) or ! %r{\A/}.match(path_string)
end.compact
relative.each do |path_string|
opoo %Q{Skipping #{action} for relative path #{path_string}}
end

1
test/support/Casks/with-installable.rb
View file

@ -10,5 +10,6 @@ class WithInstallable < TestCask
'/permissible/absolute/path',
'~/impermissible/path/with/tilde',
'impermissible/relative/path',
'/another/impermissible/../relative/path',
]
end