m/pyenv
1
0
Fork 0
mirror of https://github.com/pyenv/pyenv.git synced 2025-11-16 23:33:45 -05:00
Code Wiki Activity

Merge pull request #1156 from rbenv/no-dir-traversal

Browse Source 
Disallow path segments and directory traversal in `.ruby-version` files
This commit is contained in:
Mislav Marohnić
2019-04-04 16:21:05 +02:00
committed by GitHub
parent a3fa9b73b8 370c26a6c9
commit 4e923221ce
2 changed files with 19 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libexec/rbenv-version-file-read
View File

@@ -11,7 +11,9 @@ if [ -e "$VERSION_FILE" ]; then
words=( $(cut -b 1-1024 "$VERSION_FILE") )
version="${words[0]}"
if [ -n "$version" ]; then
if [ "$version" = ".." ] || [[ $version == */* ]]; then
echo "rbenv: invalid version in \`$VERSION_FILE'" >&2
elif [ -n "$version" ]; then
echo "$version"
exit
fi

16
test/version-file-read.bats
View File

@@ -70,3 +70,19 @@ IN
run rbenv-version-file-read my-version
assert_success "1.9.3"
}
@test "prevents directory traversal" {
cat > my-version <<<".."
run rbenv-version-file-read my-version
assert_failure "rbenv: invalid version in \`my-version'"
cat > my-version <<<"../foo"
run rbenv-version-file-read my-version
assert_failure "rbenv: invalid version in \`my-version'"
}
@test "disallows path segments in version string" {
cat > my-version <<<"foo/bar"
run rbenv-version-file-read my-version
assert_failure "rbenv: invalid version in \`my-version'"
}