New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix #1741 by trying to repair the file paths and writing a warning. #1755

Merged
merged 2 commits into from Jun 25, 2016

Conversation

Projects
None yet
2 participants
@matthid
Member

matthid commented Jun 24, 2016

I agree with trying to fix the package, but while starting to implement option 3, I think there is a problem. People can call their file %2e%2e%5c%2e%2e%5ctest (= ....\test) and make paket write anywhere. It shouldn't be more security relevant than using a type provider but I don't the idea of people depending on something like that therefore I tried to prevent it.

Show outdated Hide outdated src/Paket.Core/NuGetV2.fs
if newName.Contains "..\\" then
failwithf "Relative paths are not supported. Please tell the package author to fix the package to not use relative paths. The invalid file was '%s'" file.FullName
if newName.Contains "\\" then
traceWarnfn "File '%s' contains backslashes, probably because it wasn't properly packaged (for example with windows paths in nuspec on a unix like system). Please tell the package author to fix it." file.FullName

This comment has been minimized.

@matthid

matthid Jun 24, 2016

Member

If people start to complain about the new warnings you can remove this line (but I don't think they will as they would have noticed by now that paket3 wasn't working).

@matthid

matthid Jun 24, 2016

Member

If people start to complain about the new warnings you can remove this line (but I don't think they will as they would have noticed by now that paket3 wasn't working).

@matthid

This comment has been minimized.

Show comment
Hide comment
@matthid

matthid Jun 24, 2016

Member

O wow you can use %2e%2e%2f%2e%2e%2ftest as well

Member

matthid commented Jun 24, 2016

O wow you can use %2e%2e%2f%2e%2e%2ftest as well

@forki forki merged commit d4f551c into fsprojects:master Jun 25, 2016

2 checks passed

continuous-integration/appveyor/pr AppVeyor build succeeded
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details
@forki

This comment has been minimized.

Show comment
Hide comment
@forki

forki Jun 25, 2016

Member

;-) thx

Member

forki commented Jun 25, 2016

;-) thx

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment