cerc-io/solidity
11
0
Fork 0
mirror of https://github.com/ethereum/solidity synced 2023-10-03 13:03:40 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Normalize allowed paths before comparing them with imports

Browse Source
This commit is contained in:
Kamil Śliwak
2021-09-27 13:14:10 +02:00
parent a436abfb25
commit 52dd39212d
3 changed files with 86 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libsolidity/interface/FileReader.cpp
+5 -9
View File
@@ -69,20 +69,16 @@ ReadCallback::Result FileReader::readFile(string const& _kind, string const& _so
if (strippedSourceUnitName.find("file://") == 0)
strippedSourceUnitName.erase(0, 7);
auto canonicalPath = boost::filesystem::weakly_canonical(m_basePath / strippedSourceUnitName);
auto canonicalPath = normalizeCLIPathForVFS(m_basePath / strippedSourceUnitName, SymlinkResolution::Enabled);
bool isAllowed = false;
for (auto const& allowedDir: m_allowedDirectories)
{
// If dir is a prefix of boostPath, we are fine.
if (
std::distance(allowedDir.begin(), allowedDir.end()) <= std::distance(canonicalPath.begin(), canonicalPath.end()) &&
std::equal(allowedDir.begin(), allowedDir.end(), canonicalPath.begin())
)
for (boost::filesystem::path const& allowedDir: m_allowedDirectories)
if (isPathPrefix(normalizeCLIPathForVFS(allowedDir, SymlinkResolution::Enabled), canonicalPath))
{
isAllowed = true;
break;
}
}
if (!isAllowed)
return ReadCallback::Result{false, "File outside of allowed directories."};