[
https://issues.apache.org/jira/browse/GROOVY-12360?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18111985#comment-18111985
]
ASF GitHub Bot commented on GROOVY-12360:
-----------------------------------------
codecov-commenter commented on PR #2890:
URL: https://github.com/apache/groovy/pull/2890#issuecomment-5556870592
##
[Codecov](https://app.codecov.io/gh/apache/groovy/pull/2890?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 71.0976%. Comparing base
([`0c4dd93`](https://app.codecov.io/gh/apache/groovy/commit/0c4dd93ee000639493bdaf480edbd05f02633fd8?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache))
to head
([`1cb578c`](https://app.codecov.io/gh/apache/groovy/commit/1cb578c0941a549842260226434f938e45cc0d2d?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
:warning: Report is 3 commits behind head on master.
<details><summary>Additional details and impacted files</summary>
[](https://app.codecov.io/gh/apache/groovy/pull/2890?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
```diff
@@ Coverage Diff @@
## master #2890 +/- ##
==================================================
- Coverage 71.1006% 71.0976% -0.0030%
- Complexity 37348 37350 +2
==================================================
Files 1579 1579
Lines 135477 135487 +10
Branches 25104 25107 +3
==================================================
+ Hits 96325 96328 +3
- Misses 30478 30480 +2
- Partials 8674 8679 +5
```
| [Files with missing
lines](https://app.codecov.io/gh/apache/groovy/pull/2890?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
| Coverage Δ | |
|---|---|---|
|
[...dehaus/groovy/tools/groovydoc/GroovyDocWriter.java](https://app.codecov.io/gh/apache/groovy/pull/2890?src=pr&el=tree&filepath=subprojects%2Fgroovy-groovydoc%2Fsrc%2Fmain%2Fjava%2Forg%2Fcodehaus%2Fgroovy%2Ftools%2Fgroovydoc%2FGroovyDocWriter.java&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-c3VicHJvamVjdHMvZ3Jvb3Z5LWdyb292eWRvYy9zcmMvbWFpbi9qYXZhL29yZy9jb2RlaGF1cy9ncm9vdnkvdG9vbHMvZ3Jvb3Z5ZG9jL0dyb292eURvY1dyaXRlci5qYXZh)
| `88.1188% <100.0000%> (+1.1623%)` | :arrow_up: |
|
[...odehaus/groovy/tools/groovydoc/MockOutputTool.java](https://app.codecov.io/gh/apache/groovy/pull/2890?src=pr&el=tree&filepath=subprojects%2Fgroovy-groovydoc%2Fsrc%2Fmain%2Fjava%2Forg%2Fcodehaus%2Fgroovy%2Ftools%2Fgroovydoc%2FMockOutputTool.java&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-c3VicHJvamVjdHMvZ3Jvb3Z5LWdyb292eWRvYy9zcmMvbWFpbi9qYXZhL29yZy9jb2RlaGF1cy9ncm9vdnkvdG9vbHMvZ3Jvb3Z5ZG9jL01vY2tPdXRwdXRUb29sLmphdmE=)
| `43.3333% <100.0000%> (+1.9540%)` | :arrow_up: |
... and [79 files with indirect coverage
changes](https://app.codecov.io/gh/apache/groovy/pull/2890/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
</details>
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test
Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests,
report on failures, and find test suite problems.
- :package: [JS Bundle
Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save
yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
> GroovyDocWriter: keep generated pages inside the destination directory
> ----------------------------------------------------------------------
>
> Key: GROOVY-12360
> URL: https://issues.apache.org/jira/browse/GROOVY-12360
> Project: Groovy
> Issue Type: Improvement
> Reporter: Paul King
> Assignee: Paul King
> Priority: Major
>
> A class page was written to destdir + "/" + fullPathName + ".html", and a
> package page under destdir + "/" + packageDoc.name(), with the only guard
> being that the name is not absolute. The name is a package path, and it
> picks up a ".." segment when a source file is named through a source path
> with one — so a page could be written above the destination directory:
> fullPathName = ../srcroot/sub/Pwned
> -> <destdir>/../srcroot/sub/Pwned.html written outside destdir
> The absolute-only check is replaced by one that normalises the resolved
> path and confirms it stays within the destination directory, at both the
> class-page and package-page sites. A name that would escape is skipped
> with a warning rather than followed. The check is on the normalised paths,
> so it does not rely on names having been sanitised earlier, and a
> legitimate package like a/b/c still resolves within destdir and is
> unaffected.
> The regression test builds a doc whose path carries "..", renders through
> a mock output tool, and asserts that nothing it wrote resolves outside the
> destination. It was confirmed to fail without the guard, writing to
> <destdir>/../.../Pwned.html.
> MockOutputTool gains a getOutputs() accessor so the test can inspect every
> written path; it previously exposed only single-file lookup.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
