Passing the relative path to working directory to `DownloadStarterProjectAsDir` causes error

[michael-valdron]

/kind bug

Which area this bug is related to?

/area registry

What versions of software are you using?

Operating System: Linux

Go Pkg Version: 1.18

Bug Summary

Describe the bug:

Invoking DownloadStarterProjectAsDir from the registry library api with the destination directory set to . causes the SlipZip check for extracting the starter project to error incorrectly. This is due to filepath.Join("./", filename) resulting in no prefix where the check expects ./ as the prefix.

To Reproduce:

import (
   "log"

    registryLibrary "github.com/devfile/registry-support/registry-library/library"
)

options := registryLibrary.RegistryOptions{
    NewIndexSchema: true,
}
err := registryLibrary.DownloadStarterProjectAsDir(".", "https://registry.devfile.io", "go", "go-starter", options)
log.Println(err.Error())

Expected behavior

Any logs, error output, screenshots etc? Provide the devfile that sees this bug, if applicable.

2022/07/14 16:52:25 invalid file path .gitignore

Additional context

Any workaround?

Use absolute path instead of relative path when specifying the working directory. E.g. If Shell, use $PWD instead of .. If Go, use os.Getwd() instead of ".".

Suggestion on how to fix the bug

Correct the if statement on this line to:

if filePath != file.Name && !strings.HasPrefix(filePath, filepath.Clean(path)+string(os.PathSeparator)) {
    return fmt.Errorf("invalid file path %s", filePath)
}

Target Date: 07-21-2022