Merge pull request #7644 from backstage/rugvip/scafoodler-fixes

scaffolder-backend: release sourcePath fix from #7588

.changeset/stale-poets-destroy.md

@@ -1,6 +0,0 @@
----
-'@backstage/plugin-scaffolder-backend': patch
----
-
-Make sure `sourcePath` of `publish:github:pull-request` can only be used to
-retrieve files from the workspace.

plugins/scaffolder-backend/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @backstage/plugin-scaffolder-backend
 
+## 0.15.9
+
+### Patch Changes
+
+- 0f99f1170e: Make sure `sourcePath` of `publish:github:pull-request` can only be used to
+  retrieve files from the workspace.
+
 ## 0.15.8
 
 ### Patch Changes

plugins/scaffolder-backend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@backstage/plugin-scaffolder-backend",
   "description": "The Backstage backend plugin that helps you create new things",
-  "version": "0.15.8",
+  "version": "0.15.9",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "license": "Apache-2.0",

plugins/scaffolder-backend/src/scaffolder/actions/builtin/publish/util.ts

@@ -15,6 +15,7 @@
  */
 
 import { InputError } from '@backstage/errors';
+import { isChildPath } from '@backstage/backend-common';
 import { join as joinPath, normalize as normalizePath } from 'path';
 import { ScmIntegrationRegistry } from '@backstage/integration';
 
@@ -27,7 +28,11 @@ export const getRepoSourceDirectory = (
       /^(\.\.(\/|\\|$))+/,
       '',
     );
-    return joinPath(workspacePath, safeSuffix);
+    const path = joinPath(workspacePath, safeSuffix);
+    if (!isChildPath(workspacePath, path)) {
+      throw new Error('Invalid source path');
+    }
+    return path;
   }
   return workspacePath;
 };