renovate/renovate
1
0
Fork 0
mirror of https://github.com/renovatebot/renovate.git synced 2025-01-13 07:26:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

fix(fs): remove regex path validation (#21871)

Browse source
This commit is contained in:
Michael Kriese 2023-04-28 14:31:32 +02:00 committed by GitHub
parent c00732f262
commit 9f01274911
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 7 additions and 25 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
lib/modules/manager/gitlabci/extract.ts
View file

@ -1,7 +1,7 @@
import is from '@sindresorhus/is';
import { load } from 'js-yaml';
import { logger } from '../../../logger';
import { isValidLocalPath, readLocalFile } from '../../../util/fs';
import { readLocalFile } from '../../../util/fs';
import { trimLeadingSlash } from '../../../util/url';
import type {
ExtractConfig,
@ -133,11 +133,6 @@ export async function extractAllPackageFiles(
while (filesToExamine.length > 0) {
const file = filesToExamine.pop()!;
if (!isValidLocalPath(file)) {
logger.debug(`Invalid gitlabci file path ${file}`);
continue;
}
const content = await readLocalFile(file, 'utf8');
if (!content) {
logger.debug(`Empty or non existent gitlabci file ${file}`);

4
lib/modules/manager/gomod/artifacts.spec.ts
View file

@ -1973,7 +1973,7 @@ describe('modules/manager/gomod/artifacts', () => {
).toBeNull();
expect(execSnapshots).toMatchObject([
{
cmd: 'go get -d -t . foo .bar/... cat',
cmd: "go get -d -t . foo .bar/... '&&' cat",
options: {
cwd: '/tmp/github/some/repo',
},
@ -2039,7 +2039,7 @@ describe('modules/manager/gomod/artifacts', () => {
newPackageFileContent: gomod1,
config: {
...config,
goGetDirs: ['&&', '||'],
goGetDirs: ['/etc', '../../../'],
},
})
).toEqual([

8
lib/util/fs/util.spec.ts
View file

@ -64,14 +64,14 @@ describe('util/fs/util', () => {
${'./foo/..../bar'} | ${true}
${'./..'} | ${false}
${'\\foo'} | ${false}
${"foo'"} | ${false}
${'fo"o'} | ${false}
${'fo&o'} | ${false}
${"foo'"} | ${true}
${'fo"o'} | ${true}
${'fo&o'} | ${true}
${'f;oo'} | ${true}
${'f o o'} | ${true}
${'/'} | ${false}
${'/foo'} | ${false}
${'&&'} | ${false}
${'&&'} | ${true}
${';'} | ${true}
${'./[foo]/bar'} | ${true}
`('isValidPath($value) == $expected', ({ value, expected }) => {

13
lib/util/fs/util.ts
View file

@ -3,10 +3,6 @@ import { GlobalConfig } from '../../config/global';
import { FILE_ACCESS_VIOLATION_ERROR } from '../../constants/error-messages';
import { logger } from '../../logger';
// http://www.mtu.edu/umc/services/digital/writing/characters-avoid/
// We allow spaces, but not newlines
const restricted = /[#%&<>*?\b\n\r\0!'"|‘“^`]/;
function assertBaseDir(path: string, baseDir: string): void {
if (!path.startsWith(baseDir)) {
logger.debug(
@ -18,11 +14,6 @@ function assertBaseDir(path: string, baseDir: string): void {
}
function ensurePath(path: string, key: 'localDir' | 'cacheDir'): string {
if (restricted.test(path)) {
logger.debug({ path }, 'Preventing access to path with illegal characters');
throw new Error(FILE_ACCESS_VIOLATION_ERROR);
}
const baseDir = upath.resolve(GlobalConfig.get(key)!);
const fullPath = upath.resolve(
upath.isAbsolute(path) ? path : upath.join(baseDir, path)
@ -43,10 +34,6 @@ export function isValidPath(
path: string,
key: 'localDir' | 'cacheDir'
): boolean {
if (restricted.test(path)) {
return false;
}
const baseDir = upath.resolve(GlobalConfig.get(key)!);
const fullPath = upath.resolve(
upath.isAbsolute(path) ? path : upath.join(baseDir, path)