[ fix ] Prevent relative path traversal in elaborator scripts

idris-lang · Oct 16, 2023 · 3e5d8a5 · 3e5d8a5
1 parent c04404a
commit 3e5d8a5
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/src/TTImp/Elab/RunElab.idr b/src/TTImp/Elab/RunElab.idr
@@ -129,6 +129,7 @@ elabScript rig fc nest env script@(NDCon nfc nm t ar args) exp
         pathDoesNotEscape _     []           = True
         pathDoesNotEscape Z     (".."::rest) = False
         pathDoesNotEscape (S n) (".."::rest) = pathDoesNotEscape n rest
+        pathDoesNotEscape n     ("." ::rest) = pathDoesNotEscape n rest
         pathDoesNotEscape n     (_   ::rest) = pathDoesNotEscape (S n) rest
 
     elabCon : Defs -> String -> List (Closure vars) -> Core (NF vars)

diff --git a/tests/idris2/reflection/reflection024/src/LessSimpleRW.idr b/tests/idris2/reflection/reflection024/src/LessSimpleRW.idr
@@ -35,3 +35,8 @@ failing "path must not escape the directory"
 
   -- Check a slightly more complicated case of escaping
   %runElab readAndLog "nonExistentOriginally/../../whatever"
+
+failing "path must not escape the directory"
+
+  -- Check that '.' does not allow escaping
+  %runElab readAndLog "./../whatever"