Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Throw a more user-friendly error on invalid file path when resolving path to a pack resource #4046

Merged
merged 7 commits into from
Mar 20, 2018

Conversation

Kami
Copy link
Member

@Kami Kami commented Mar 20, 2018

For security reasons (to avoid directory traversal attacks, writing outside of the pack directory, etc.), we only allow users to write pack data files inside the pack directory.

The error we threw before was a bit ambiguous and not user-friendly so this PR fixes that.

Before:

Invalid file path: /opt/stackstorm/packs/dummy_pack_2/bar.py

After:

Invalid file path: /opt/stackstorm/packs/dummy_pack_2/bar.py. File path needs to be relative to the pack actions directory (opt/stackstorm/packs/test/actions). For example "my_action.py".

Related issue #4039.

Copy link
Contributor

@bigmstone bigmstone left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@Kami Kami merged commit 55631a8 into master Mar 20, 2018
@Kami Kami deleted the invalid_file_path_friendly_error branch March 20, 2018 11:56
@arm4b
Copy link
Member

arm4b commented Mar 20, 2018

Do we auto-generate https://api.stackstorm.com/ somehow based on latest API definition?
I guess it's outdated

@Kami
Copy link
Member Author

Kami commented Mar 20, 2018

IIRC, we re-generate it on master build, but I could be wrong - @enykeev should know for sure.

@arm4b
Copy link
Member

arm4b commented Mar 20, 2018

From S3, last update: Nov 3, 2017 😞

Something to keep in mind, when pointing to https://api.stackstorm.com/ in #community.

@Kami Kami added this to the 2.7.0 milestone Apr 3, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants