Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix #1741 by trying to repair the file paths and writing a warning. #1755

Merged
merged 2 commits into from Jun 25, 2016

Conversation

matthid
Copy link
Member

@matthid matthid commented Jun 24, 2016

I agree with trying to fix the package, but while starting to implement option 3, I think there is a problem. People can call their file %2e%2e%5c%2e%2e%5ctest (= ....\test) and make paket write anywhere. It shouldn't be more security relevant than using a type provider but I don't the idea of people depending on something like that therefore I tried to prevent it.

if newName.Contains "..\\" then
failwithf "Relative paths are not supported. Please tell the package author to fix the package to not use relative paths. The invalid file was '%s'" file.FullName
if newName.Contains "\\" then
traceWarnfn "File '%s' contains backslashes, probably because it wasn't properly packaged (for example with windows paths in nuspec on a unix like system). Please tell the package author to fix it." file.FullName
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If people start to complain about the new warnings you can remove this line (but I don't think they will as they would have noticed by now that paket3 wasn't working).

@matthid
Copy link
Member Author

matthid commented Jun 24, 2016

O wow you can use %2e%2e%2f%2e%2e%2ftest as well

@forki forki merged commit d4f551c into fsprojects:master Jun 25, 2016
@forki
Copy link
Member

forki commented Jun 25, 2016

;-) thx

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants