[
https://issues.apache.org/jira/browse/GROOVY-12360?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18111994#comment-18111994
]
ASF GitHub Bot commented on GROOVY-12360:
-----------------------------------------
testlens-app[bot] commented on PR #2890:
URL: https://github.com/apache/groovy/pull/2890#issuecomment-5557024160
## ✅ All tests passed ✅
🏷️ Commit: 1cb578c0941a549842260226434f938e45cc0d2d
▶️ Tests: 116796 executed
⚪️ Checks: 32/32 completed
---
_Learn more about TestLens at
[testlens.app/docs](https://testlens.app/docs/features/pr-comment/)._
> GroovyDocWriter: keep generated pages inside the destination directory
> ----------------------------------------------------------------------
>
> Key: GROOVY-12360
> URL: https://issues.apache.org/jira/browse/GROOVY-12360
> Project: Groovy
> Issue Type: Improvement
> Reporter: Paul King
> Assignee: Paul King
> Priority: Major
>
> A class page was written to destdir + "/" + fullPathName + ".html", and a
> package page under destdir + "/" + packageDoc.name(), with the only guard
> being that the name is not absolute. The name is a package path, and it
> picks up a ".." segment when a source file is named through a source path
> with one — so a page could be written above the destination directory:
> fullPathName = ../srcroot/sub/Pwned
> -> <destdir>/../srcroot/sub/Pwned.html written outside destdir
> The absolute-only check is replaced by one that normalises the resolved
> path and confirms it stays within the destination directory, at both the
> class-page and package-page sites. A name that would escape is skipped
> with a warning rather than followed. The check is on the normalised paths,
> so it does not rely on names having been sanitised earlier, and a
> legitimate package like a/b/c still resolves within destdir and is
> unaffected.
> The regression test builds a doc whose path carries "..", renders through
> a mock output tool, and asserts that nothing it wrote resolves outside the
> destination. It was confirmed to fail without the guard, writing to
> <destdir>/../.../Pwned.html.
> MockOutputTool gains a getOutputs() accessor so the test can inspect every
> written path; it previously exposed only single-file lookup.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
