From c22fc45ffae50c79fb9682e9c57305347d230576 Mon Sep 17 00:00:00 2001 From: Mike Lewis Date: Tue, 6 Jul 2021 15:30:04 +0100 Subject: [PATCH] scaffolder: use resolveSafeChildPath in fetch:template Signed-off-by: Mike Lewis --- .../scaffolder/actions/builtin/fetch/template.test.ts | 4 +++- .../src/scaffolder/actions/builtin/fetch/template.ts | 10 ++-------- 2 files changed, 5 insertions(+), 9 deletions(-) diff --git a/plugins/scaffolder-backend/src/scaffolder/actions/builtin/fetch/template.test.ts b/plugins/scaffolder-backend/src/scaffolder/actions/builtin/fetch/template.test.ts index 3ab96a367e..dbdb3feff1 100644 --- a/plugins/scaffolder-backend/src/scaffolder/actions/builtin/fetch/template.test.ts +++ b/plugins/scaffolder-backend/src/scaffolder/actions/builtin/fetch/template.test.ts @@ -92,7 +92,9 @@ describe('fetch:template', () => { it('throws if output directory is outside the workspace', async () => { await expect(() => action.handler(mockContext({ targetPath: '../' })), - ).rejects.toThrowError(/outside the working directory/i); + ).rejects.toThrowError( + /relative path is not allowed to refer to a directory outside its parent/i, + ); }); it('throws if copyWithoutRender parameter is not an array', async () => { diff --git a/plugins/scaffolder-backend/src/scaffolder/actions/builtin/fetch/template.ts b/plugins/scaffolder-backend/src/scaffolder/actions/builtin/fetch/template.ts index 05e7ebaaa6..c45f429929 100644 --- a/plugins/scaffolder-backend/src/scaffolder/actions/builtin/fetch/template.ts +++ b/plugins/scaffolder-backend/src/scaffolder/actions/builtin/fetch/template.ts @@ -15,7 +15,7 @@ */ import path, { resolve as resolvePath } from 'path'; -import { UrlReader } from '@backstage/backend-common'; +import { resolveSafeChildPath, UrlReader } from '@backstage/backend-common'; import { InputError } from '@backstage/errors'; import { ScmIntegrations } from '@backstage/integration'; import { fetchContents } from './helpers'; @@ -104,13 +104,7 @@ export function createFetchTemplateAction(options: { const templateDir = resolvePath(workDir, 'template'); const targetPath = ctx.input.targetPath ?? './'; - const outputDir = path.resolve(ctx.workspacePath, targetPath); - - if (!outputDir.startsWith(ctx.workspacePath)) { - throw new InputError( - `Fetch action targetPath may not specify a path outside the working directory`, - ); - } + const outputDir = resolveSafeChildPath(ctx.workspacePath, targetPath); if ( ctx.input.copyWithoutRender &&