haskal
/
vagrant
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

load_dotfile uses path traversal and not a regex

This commit is contained in:
John Bender 2010-01-30 01:03:18 -08:00
parent 62c6d91a24
commit e8d9f07c94
3 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/hobo.rb
View File

@ -2,8 +2,8 @@ libdir = File.dirname(__FILE__)
$:.unshift(libdir) $:.unshift(libdir)
PROJECT_ROOT = File.join(libdir, '..') PROJECT_ROOT = File.join(libdir, '..')
require 'ostruct'
require 'ftools' require 'ftools'
require 'pathname'
require 'logger' require 'logger'
require 'virtualbox' require 'virtualbox'
require 'hobo/config' require 'hobo/config'

10
lib/hobo/env.rb
View File

@ -8,7 +8,7 @@ module Hobo
:files => CONFIG.merge({}), #additional files go mhia! :files => CONFIG.merge({}), #additional files go mhia!
:dirs => [HOME] #additional dirs go mhia! :dirs => [HOME] #additional dirs go mhia!
} }
PATH_CHUNK_REGEX = /\/[^\/]+$/
class << self class << self
def load! def load!
@ -41,16 +41,16 @@ module Hobo
@@persisted_uuid = load_dotfile @@persisted_uuid = load_dotfile
end end
def load_dotfile(dir=Dir.pwd) def load_dotfile(path=Pathname.new(Dir.pwd))
return nil if dir.empty? return nil if path.to_s == '/'
file = "#{dir}/#{Hobo.config[:dotfile_name]}" file = "#{path}/#{Hobo.config[:dotfile_name]}"
if File.exists?(file) if File.exists?(file)
# TODO check multiple lines after the first for information # TODO check multiple lines after the first for information
return File.open(file, 'r').first return File.open(file, 'r').first
end end
load_dotfile(dir.sub(PATH_CHUNK_REGEX, '')) load_dotfile(path.parent)
end end
def persisted_uuid def persisted_uuid

3
test/hobo/env_test.rb
View File

@ -73,9 +73,10 @@ class EnvTest < Test::Unit::TestCase
test "should walk the parent directories looking for the dotfile" do test "should walk the parent directories looking for the dotfile" do
Hobo.config! hobo_mock_config Hobo.config! hobo_mock_config
#Expects exists with the current directory and .hobo #Expects exists with the current directory and .hobo
File.expects(:exists?).with(dotfile).returns(false) File.expects(:exists?).with(dotfile).returns(false)
File.expects(:exists?).with(dotfile(Dir.pwd.sub(Hobo::Env::PATH_CHUNK_REGEX, ''))).returns(true) File.expects(:exists?).with(dotfile(Dir.pwd.split('/')[0..-2].join('/'))).returns(true)
File.expects(:open).returns(['foo']) File.expects(:open).returns(['foo'])
Hobo::Env.load_uuid! Hobo::Env.load_uuid!
assert_equal Hobo::Env.persisted_uuid, 'foo' assert_equal Hobo::Env.persisted_uuid, 'foo'