paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 27 Packages Projects Releases Wiki Activity

backend-common,cli-common: new utilites for safely resolving child paths

Browse Source 
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
This commit is contained in:
Patrik Oldsberg
2021-06-24 17:27:05 +02:00
parent 31e4c48afc
commit ab5cc376fa
18 changed files with 175 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/scaffolder-backend/src/scaffolder/actions/builtin/fetch/cookiecutter.test.ts
+1 -1
View File
@@ -180,7 +180,7 @@ describe('fetch:cookiecutter', () => {
},
}),
).rejects.toThrow(
/targetPath may not specify a path outside the working directory/,
/Relative path is not allowed to refer to a directory outside its parent/,
);
});
});
plugins/scaffolder-backend/src/scaffolder/actions/builtin/fetch/cookiecutter.ts
+2 -7
View File
@@ -14,7 +14,7 @@
* limitations under the License.
*/
import { UrlReader } from '@backstage/backend-common';
import { UrlReader, resolveSafeChildPath } from '@backstage/backend-common';
import { JsonObject } from '@backstage/config';
import { InputError } from '@backstage/errors';
import { ScmIntegrations } from '@backstage/integration';
@@ -138,12 +138,7 @@ export function createFetchCookiecutterAction(options: {
// Finally move the template result into the task workspace
const targetPath = ctx.input.targetPath ?? './';
const outputPath = resolvePath(ctx.workspacePath, targetPath);
if (!outputPath.startsWith(ctx.workspacePath)) {
throw new InputError(
`Fetch action targetPath may not specify a path outside the working directory`,
);
}
const outputPath = resolveSafeChildPath(ctx.workspacePath, targetPath);
await fs.copy(resultDir, outputPath);
},
});
plugins/scaffolder-backend/src/scaffolder/actions/builtin/fetch/plain.test.ts
+1 -1
View File
@@ -62,7 +62,7 @@ describe('fetch:plain', () => {
},
}),
).rejects.toThrow(
/Fetch action targetPath may not specify a path outside the working directory/,
/Relative path is not allowed to refer to a directory outside its parent/,
);
});
plugins/scaffolder-backend/src/scaffolder/actions/builtin/fetch/plain.ts
+2 -9
View File
@@ -14,9 +14,7 @@
* limitations under the License.
*/
import path from 'path';
import { UrlReader } from '@backstage/backend-common';
import { InputError } from '@backstage/errors';
import { UrlReader, resolveSafeChildPath } from '@backstage/backend-common';
import { ScmIntegrations } from '@backstage/integration';
import { fetchContents } from './helpers';
import { createTemplateAction } from '../../createTemplateAction';
@@ -56,12 +54,7 @@ export function createFetchPlainAction(options: {
// Finally move the template result into the task workspace
const targetPath = ctx.input.targetPath ?? './';
const outputPath = path.resolve(ctx.workspacePath, targetPath);
if (!outputPath.startsWith(ctx.workspacePath)) {
throw new InputError(
`Fetch action targetPath may not specify a path outside the working directory`,
);
}
const outputPath = resolveSafeChildPath(ctx.workspacePath, targetPath);
await fetchContents({
reader,