From f24e726ba53e23235d33d8bdc7877ad3a8632fde Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Tue, 6 Feb 2018 14:35:14 +0100 Subject: [PATCH] checkURI(): Check file URIs against allowedPaths This makes e.g. 'fetchGit ./.' work (assuming that ./. is an allowed path). --- src/libexpr/eval.cc | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc index 33a9bc614..7775cbe53 100644 --- a/src/libexpr/eval.cc +++ b/src/libexpr/eval.cc @@ -378,6 +378,18 @@ void EvalState::checkURI(const std::string & uri) && (prefix[prefix.size() - 1] == '/' || uri[prefix.size()] == '/'))) return; + /* If the URI is a path, then check it against allowedPaths as + well. */ + if (hasPrefix(uri, "/")) { + checkSourcePath(uri); + return; + } + + if (hasPrefix(uri, "file://")) { + checkSourcePath(std::string(uri, 7)); + return; + } + throw RestrictedPathError("access to URI '%s' is forbidden in restricted mode", uri); }