Class: Petticoat::InstallationPath

Inherits:
Object
  • Object
show all
Defined in:
lib/petticoat/installation_path.rb

Overview

Reject symlinks and non-directory parents inside the selected checkout.

Instance Method Summary collapse

Constructor Details

#initialize(root, relative) ⇒ InstallationPath

Returns a new instance of InstallationPath.



6
7
8
9
10
11
12
13
14
15
16
 
# File 'lib/petticoat/installation_path.rb', line 6

def initialize(root, relative)
  parts = relative.split('/')
  if relative.empty? || relative.start_with?('/') || parts.any? { |part| ['', '.', '..'].include?(part) } ||
     relative.include?("\0") || relative.include?('\\')
    raise Error, 'Petticoat: unsafe installation path.'
  end

  @root = File.realpath(root)
  @parts = parts
  @relative = relative
end

Instance Method Details

#checked ⇒ Object 



18
19
20
21
22
23
24
25
26
27
 
# File 'lib/petticoat/installation_path.rb', line 18

def checked
  path = @root
  @parts.each_with_index do |part, index|
    path = File.join(path, part)
    invalid = File.symlink?(path) ||
              (File.exist?(path) && (index == @parts.size - 1 ? !File.file?(path) : !File.directory?(path)))
    raise Error, "Petticoat: unsafe installation path: #{@relative}." if invalid
  end
  path
end