Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

double check target path is inside currentDir #222

Merged
merged 1 commit into from
Oct 25, 2024
Merged

double check target path is inside currentDir #222

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions src/gt-pull.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,7 +185,7 @@ function gt_pull() {
# before we report about missing arguments we check if the working directory exists and
# if it is inside of the call location
exitIfWorkingDirDoesNotExist "$workingDir"
exitIfDirectoryNamedIsOutsideOf "$workingDir" "working directory" "$currentDir"
exitIfPathNamedIsOutsideOf "$workingDir" "working directory" "$currentDir"

# if remote does not exist then pull.args does not and most likely pullDir is thus not defined, in this case we want
# to show the error about the non existing remote before other missing arguments
Expand All @@ -208,7 +208,7 @@ function gt_pull() {
workingDirAbsolute=$(readlink -m "$workingDir") || die "could not deduce workingDirAbsolute from %s" "$workingDir"
pullDirAbsolute=$(readlink -m "$pullDir")
local -r workingDirAbsolute pullDirAbsolute
checkIfDirectoryNamedIsOutsideOf "$pullDirAbsolute" "pull directory" "$currentDir" || return $?
checkIfPathNamedIsOutsideOf "$pullDirAbsolute" "pull directory" "$currentDir" || return $?

local publicKeysDir repo gpgDir pulledTsv pullHookFile
source "$dir_of_gt/paths.source.sh" || traceAndDie "could not source paths.source.sh"
Expand Down Expand Up @@ -426,6 +426,10 @@ function gt_pull() {

local absoluteFile
while read -r -d $'\0' absoluteFile; do
# in theory this check should not be necessary as we already check that the pullDir is not outside
# but better be sure as we don't want that `gt re-pull` can be a security risk (leaving pull-hooks aside)
checkIfPathNamedIsOutsideOf "$absoluteFile" "target path" "$currentDir" || return $?

local repoFile
repoFile=$(realpath --relative-to="$repo" "$absoluteFile")
if [[ $doVerification == true && -f "$absoluteFile.$sigExtension" ]]; then
Expand Down
2 changes: 1 addition & 1 deletion src/gt-re-pull.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,7 +100,7 @@ function gt_re_pull() {
# before we report about missing arguments we check if the working directory exists and
# if it is inside of the call location
exitIfWorkingDirDoesNotExist "$workingDir"
exitIfDirectoryNamedIsOutsideOf "$workingDir" "working directory" "$currentDir"
exitIfPathNamedIsOutsideOf "$workingDir" "working directory" "$currentDir"

exitIfNotAllArgumentsSet params "$examples" "$GT_VERSION"

Expand Down
6 changes: 3 additions & 3 deletions src/gt-remote.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,7 @@ function gt_remote_add() {
if ! [[ -v tagFilter ]]; then tagFilter=".*"; fi

# before we report about missing arguments we check if the working directory is inside of the call location
exitIfDirectoryNamedIsOutsideOf "$workingDir" "working directory" "$currentDir"
exitIfPathNamedIsOutsideOf "$workingDir" "working directory" "$currentDir"
exitIfNotAllArgumentsSet params "$examples" "$GT_VERSION"

local -r remoteIdentifierRegex="^[a-zA-Z0-9_-]+$"
Expand Down Expand Up @@ -256,7 +256,7 @@ function gt_remote_list_raw() {
# before we report about missing arguments we check if the working directory exists and
# if it is inside of the call location
exitIfWorkingDirDoesNotExist "$workingDir"
exitIfDirectoryNamedIsOutsideOf "$workingDir" "working directory" "$currentDir"
exitIfPathNamedIsOutsideOf "$workingDir" "working directory" "$currentDir"

exitIfNotAllArgumentsSet params "$examples" "$GT_VERSION"

Expand Down Expand Up @@ -325,7 +325,7 @@ function gt_remote_remove() {
# before we report about missing arguments we check if the working directory exists and
# if it is inside of the call location
exitIfWorkingDirDoesNotExist "$workingDir"
exitIfDirectoryNamedIsOutsideOf "$workingDir" "working directory" "$currentDir"
exitIfPathNamedIsOutsideOf "$workingDir" "working directory" "$currentDir"

exitIfNotAllArgumentsSet params "$examples" "$GT_VERSION"

Expand Down
2 changes: 1 addition & 1 deletion src/gt-reset.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ function gt_reset() {
# before we report about missing arguments we check if the working directory exists and
# if it is inside of the call location
exitIfWorkingDirDoesNotExist "$workingDir"
exitIfDirectoryNamedIsOutsideOf "$workingDir" "working directory" "$currentDir"
exitIfPathNamedIsOutsideOf "$workingDir" "working directory" "$currentDir"

exitIfNotAllArgumentsSet params "$examples" "$GT_VERSION"

Expand Down
19 changes: 0 additions & 19 deletions src/utils.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,25 +85,6 @@ function exitIfRemoteDirDoesNotExist() {
fi
}

function checkIfDirectoryNamedIsOutsideOf() {
local directory name parentDirectory
# shellcheck disable=SC2034 # is passed by name to parseFnArgs
local -ra params=(directory name parentDirectory)
parseFnArgs params "$@"

local directoryAbsolute parentDirectoryAbsolute
directoryAbsolute="$(realpath "$directory")"
parentDirectoryAbsolute="$(realpath "$parentDirectory")"
if ! [[ "$directoryAbsolute" == "$parentDirectoryAbsolute"* ]]; then
returnDying "the given \033[0;36m%s\033[0m %s is outside of %s" "$name" "$directoryAbsolute" "$parentDirectory"
fi
}

function exitIfDirectoryNamedIsOutsideOf() {
# shellcheck disable=SC2310 # we are aware of that || will disable set -e for checkIfDirectoryNamedIsOutsideOf
checkIfDirectoryNamedIsOutsideOf "$@" || exit $?
}

function invertBool() {
local b=$1
shift 1 || traceAndDie "could not shift by 1"
Expand Down