wroclaw-git-backups/nix
1
0
Fork 0
mirror of https://github.com/NixOS/nix synced 2025-07-07 01:51:47 +02:00
Code Activity

path fetcher: Fix relative path check

Browse source
This commit is contained in:
Eelco Dolstra 2021-09-21 13:19:26 +02:00
parent be69a98d2c
commit 5cbb9c5406
2 changed files with 11 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

13
src/libfetchers/path.cc
View file

@ -85,18 +85,23 @@ struct PathInputScheme : InputScheme
std::string absPath;
auto path = getStrAttr(input.attrs, "path");
if (path[0] != '/' && input.parent) {
if (path[0] != '/') {
if (!input.parent)
throw Error("cannot fetch input '%s' because it uses a relative path", input.to_string());
auto parent = canonPath(*input.parent);
// the path isn't relative, prefix it
absPath = canonPath(parent + "/" + path);
absPath = nix::absPath(path, parent);
// for security, ensure that if the parent is a store path, it's inside it
if (!parent.rfind(store->storeDir, 0) && absPath.rfind(store->storeDir, 0))
throw BadStorePath("relative path '%s' points outside of its parent's store path %s, this is a security violation", path, parent);
if (store->isInStore(parent) && !isInDir(absPath, parent))
throw BadStorePath("relative path '%s' [%s] points outside of its parent's store path '%s'", path, absPath, parent);
} else
absPath = path;
Activity act(*logger, lvlTalkative, actUnknown, fmt("copying '%s'", absPath));
// FIXME: check whether access to 'path' is allowed.
auto storePath = store->maybeParseStorePath(absPath);