Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Don't allow import to escape the subtree of a script #44

Closed
dlespiau opened this issue Nov 21, 2018 · 1 comment
Closed

Don't allow import to escape the subtree of a script #44

dlespiau opened this issue Nov 21, 2018 · 1 comment
Labels
kind/enhancement New feature or request topic/hermeticity

Comments

@dlespiau
Copy link
Member

We don't want jk scripts to be able to load arbitrary files on the system. That would allow to break hermeticity a bit too easily.
@dlespiau dlespiau added kind/bug Something isn't working kind/enhancement New feature or request and removed kind/bug Something isn't working labels Nov 21, 2018
@dlespiau dlespiau added this to the 0.3.0 milestone Jan 30, 2019
@dlespiau dlespiau changed the title Don't allow import to to escape the subtree of a script Don't allow import to escape the subtree of a script Feb 4, 2019
@dlespiau dlespiau removed this from the 0.3.0 milestone Mar 1, 2019
@squaremo
Copy link
Member

There are now two guards against this:

  • modules are loaded from virtual file systems, so paths outside the root are not accessible
  • any import path beginning with ./ or ../ is resolved by the RelativeImporter, which looks only in the virtual file system of the importing module

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
kind/enhancement New feature or request topic/hermeticity
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@dlespiau @squaremo