Module: CosmosCompatibility

Included in:
Object
Defined in:
lib/openc3/top_level.rb

Instance Method Summary collapse

Instance Method Details

#load(*args) ⇒ Object 



590
591
592
593
594
595
596
597
598
599
600
 
# File 'lib/openc3/top_level.rb', line 590

def load(*args)
  filename = args[0]
  if filename.is_a?(String) && filename.start_with?("cosmos/")
    filename = filename.sub(/^cosmos\//, "openc3/")
    unless safe_openc3_path?(filename)
      raise ArgumentError, "Unsafe path in load after cosmos->openc3 transformation: #{filename.inspect}"
    end
    args[0] = filename
  end
  super(*args)
end

#require(*args) ⇒ Object 



578
579
580
581
582
583
584
585
586
587
588
 
# File 'lib/openc3/top_level.rb', line 578

def require(*args)
  filename = args[0]
  if filename.is_a?(String) && filename.start_with?("cosmos/")
    filename = filename.sub(/^cosmos\//, "openc3/")
    unless safe_openc3_path?(filename)
      raise ArgumentError, "Unsafe path in require after cosmos->openc3 transformation: #{filename.inspect}"
    end
    args[0] = filename
  end
  super(*args)
end

#safe_openc3_path?(filename) ⇒ Boolean

Validates the filename after cosmos->openc3 transformation

Returns:

  • (Boolean) 


565
566
567
568
569
570
571
572
573
574
575
576
 
# File 'lib/openc3/top_level.rb', line 565

def safe_openc3_path?(filename)
  return false unless filename.is_a?(String)
  # Only validate paths that start with "openc3/" (transformed from "cosmos/")
  return true unless filename.start_with?("openc3/")
  # Disallow any ".." or "." path traversal
  return false if filename.include?("..") || filename.include?("./") || filename.include?("/.") || filename.include?("\\") || filename.include?("//")
  # Disallow absolute paths (Unix and Windows)
  return false if filename.start_with?("/") || filename =~ /^[a-zA-Z]:[\\\/]/
  # Disallow special characters (allow word chars, dash, slash, dot)
  return false unless filename =~ /\A[\w\-\/\.]+\z/
  true
end