backend-common,cli-common: new utilites for safely resolving child paths

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
This commit is contained in:
Patrik Oldsberg
2021-06-24 17:27:05 +02:00
parent 31e4c48afc
commit ab5cc376fa
18 changed files with 175 additions and 42 deletions
@@ -15,6 +15,7 @@
*/
import { Entity } from '@backstage/catalog-model';
import { isChildPath } from '@backstage/backend-common';
import { spawn } from 'child_process';
import fs from 'fs-extra';
import yaml, { DEFAULT_SCHEMA, Type } from 'js-yaml';
@@ -23,7 +24,6 @@ import { Logger } from 'winston';
import { ParsedLocationAnnotation } from '../../helpers';
import { RemoteProtocol } from '../prepare/types';
import { SupportedGeneratorKey } from './types';
import { resolve as resolvePath } from 'path';
// TODO: Implement proper support for more generators.
export function getGeneratorKey(entity: Entity): SupportedGeneratorKey {
@@ -178,10 +178,7 @@ export const validateMkdocsYaml = async (
schema: MKDOCS_SCHEMA,
});
if (
mkdocsYml.docs_dir &&
!resolvePath(inputDir, mkdocsYml.docs_dir).startsWith(inputDir)
) {
if (mkdocsYml.docs_dir && !isChildPath(inputDir, mkdocsYml.docs_dir)) {
throw new Error(
`docs_dir configuration value in mkdocs can't be an absolute directory or start with ../ for security reasons.
Use relative paths instead which are resolved relative to your mkdocs.yml file location.`,