mdebray/tvl-depot
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Be more strict about file names in NARs

Browse source
This commit is contained in:
Eelco Dolstra 2014-07-16 16:30:50 +02:00
parent 276a40b31f
commit 985f1595fe
1 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
src/libutil/archive.cc
View file

@ -231,7 +231,7 @@ static void parse(ParseSink & sink, Source & source, const Path & path)
} }
else if (s == "entry" && type == tpDirectory) { else if (s == "entry" && type == tpDirectory) {
string name; string name, prevName;
s = readString(source); s = readString(source);
if (s != "(") throw badArchive("expected open tag"); if (s != "(") throw badArchive("expected open tag");
@ -245,6 +245,11 @@ static void parse(ParseSink & sink, Source & source, const Path & path)
break; break;
} else if (s == "name") { } else if (s == "name") {
name = readString(source); name = readString(source);
if (name.empty() || name == "." || name == ".." || name.find('/') != string::npos || name.find((char) 0) != string::npos)
throw Error(format("NAR contains invalid file name `%1%'") % name);
if (name <= prevName)
throw Error("NAR directory is not sorted");
prevName = name;
if (useCaseHack) { if (useCaseHack) {
auto i = names.find(name); auto i = names.find(name);
if (i != names.end()) { if (i != names.end()) {