Skip to content

Normalize Paths in Filesystem Permissions to Fix Directory-Dependent Bugs #229

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Normalize Paths in Filesystem Permissions to Fix Directory-Dependent Bugs #229

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions lib/src/eval/runtime/runtime.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,8 @@ import 'dart:convert';
import 'dart:math';
import 'dart:typed_data';

import 'package:path/path.dart' as p;

import 'package:dart_eval/dart_eval.dart';
import 'package:dart_eval/dart_eval_bridge.dart';
import 'package:dart_eval/dart_eval_security.dart';
Expand Down Expand Up @@ -310,6 +312,11 @@ class Runtime {

/// Check if a permission is granted.
bool checkPermission(String domain, [Object? data]) {
if (domain == 'filesystem:read' || domain == 'filesystem:write') {
if (data is String) {
data = p.normalize(p.absolute(data));
}
}
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of putting filesystem-specific code in runtime.dart, please move this into the Filesystem*Permission match() functions

return _permissions[domain]?.any((element) => element.match(data)) ?? false;
}

Expand Down
19 changes: 13 additions & 6 deletions lib/src/eval/runtime/security/permissions/filesystem.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
import 'package:path/path.dart' as p;
import 'package:dart_eval/dart_eval_security.dart';

/// A permission that allows access to read and write a file system resource.
Expand All @@ -14,13 +15,15 @@ class FilesystemPermission implements Permission {
/// Create a new filesystem permission that matches any file in a directory
/// or one of its subdirectories.
factory FilesystemPermission.directory(String dir) {
final escaped = dir.replaceAll(r'\', r'\\').replaceAll(r'/', r'\/');
final normalized = p.normalize(p.absolute(dir));
final escaped = normalized.replaceAll(r'\', r'\\').replaceAll(r'/', r'\/');
return FilesystemPermission(RegExp('^$escaped.*'));
}

/// Create a new filesystem permission that matches a specific file.
factory FilesystemPermission.file(String file) {
final escaped = file.replaceAll(r'\', r'\\').replaceAll(r'/', r'\/');
final normalized = p.normalize(p.absolute(file));
final escaped = normalized.replaceAll(r'\', r'\\').replaceAll(r'/', r'\/');
return FilesystemPermission(RegExp('^$escaped\$'));
}

Expand Down Expand Up @@ -59,13 +62,15 @@ class FilesystemReadPermission extends FilesystemPermission {
/// Create a new filesystem permission that matches any file in a directory
/// or one of its subdirectories.
factory FilesystemReadPermission.directory(String dir) {
final escaped = dir.replaceAll(r'\', r'\\').replaceAll(r'/', r'\/');
final normalized = p.normalize(p.absolute(dir));
final escaped = normalized.replaceAll(r'\', r'\\').replaceAll(r'/', r'\/');
return FilesystemReadPermission(RegExp('^$escaped.*'));
}

/// Create a new filesystem permission that matches a specific file.
factory FilesystemReadPermission.file(String file) {
final escaped = file.replaceAll(r'\', r'\\').replaceAll(r'/', r'\/');
final normalized = p.normalize(p.absolute(file));
final escaped = normalized.replaceAll(r'\', r'\\').replaceAll(r'/', r'\/');
return FilesystemReadPermission(RegExp('^$escaped\$'));
}

Expand Down Expand Up @@ -104,13 +109,15 @@ class FilesystemWritePermission extends FilesystemPermission {
/// Create a new filesystem permission that matches any file in a directory
/// or one of its subdirectories.
factory FilesystemWritePermission.directory(String dir) {
final escaped = dir.replaceAll(r'\', r'\\').replaceAll(r'/', r'\/');
final normalized = p.normalize(p.absolute(dir));
final escaped = normalized.replaceAll(r'\', r'\\').replaceAll(r'/', r'\/');
return FilesystemWritePermission(RegExp('^$escaped.*'));
}

/// Create a new filesystem permission that matches a specific file.
factory FilesystemWritePermission.file(String file) {
final escaped = file.replaceAll(r'\', r'\\').replaceAll(r'/', r'\/');
final normalized = p.normalize(p.absolute(file));
final escaped = normalized.replaceAll(r'\', r'\\').replaceAll(r'/', r'\/');
return FilesystemWritePermission(RegExp('^$escaped\$'));
}

Expand Down