Skip to content

Normalize Paths in Filesystem Permissions to Fix Directory-Dependent Bugs #229

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 4 commits into from
Closed

Normalize Paths in Filesystem Permissions to Fix Directory-Dependent Bugs #229

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
741e161
Refactor filesystem permissions to normalize paths using 'package:pat…
May 7, 2025
0016afc
Re: Fix filesystem path normalization for permission checks
Jul 8, 2025
87e9bb3
Merge branch 'ethanblake4:master' into master
MohamedAl-Kainai Jul 8, 2025
d1a0769
Fix filesystem permission path matching by resolving symbolic links
Jul 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions lib/src/eval/runtime/runtime.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,8 @@ import 'dart:convert';
import 'dart:math';
import 'dart:typed_data';

import 'package:path/path.dart' as p;

import 'package:dart_eval/dart_eval.dart';
import 'package:dart_eval/dart_eval_bridge.dart';
import 'package:dart_eval/dart_eval_security.dart';
Expand Down Expand Up @@ -310,6 +312,11 @@ class Runtime {

/// Check if a permission is granted.
bool checkPermission(String domain, [Object? data]) {
if (domain == 'filesystem:read' || domain == 'filesystem:write') {
if (data is String) {
data = p.normalize(p.absolute(data));
}
}
return _permissions[domain]?.any((element) => element.match(data)) ?? false;
}

Expand Down
19 changes: 13 additions & 6 deletions lib/src/eval/runtime/security/permissions/filesystem.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
import 'package:path/path.dart' as p;
import 'package:dart_eval/dart_eval_security.dart';

/// A permission that allows access to read and write a file system resource.
Expand All @@ -14,13 +15,15 @@ class FilesystemPermission implements Permission {
/// Create a new filesystem permission that matches any file in a directory
/// or one of its subdirectories.
factory FilesystemPermission.directory(String dir) {
final escaped = dir.replaceAll(r'\', r'\\').replaceAll(r'/', r'\/');
final normalized = p.normalize(p.absolute(dir));
final escaped = normalized.replaceAll(r'\', r'\\').replaceAll(r'/', r'\/');
return FilesystemPermission(RegExp('^$escaped.*'));
}

/// Create a new filesystem permission that matches a specific file.
factory FilesystemPermission.file(String file) {
final escaped = file.replaceAll(r'\', r'\\').replaceAll(r'/', r'\/');
final normalized = p.normalize(p.absolute(file));
final escaped = normalized.replaceAll(r'\', r'\\').replaceAll(r'/', r'\/');
return FilesystemPermission(RegExp('^$escaped\$'));
}

Expand Down Expand Up @@ -59,13 +62,15 @@ class FilesystemReadPermission extends FilesystemPermission {
/// Create a new filesystem permission that matches any file in a directory
/// or one of its subdirectories.
factory FilesystemReadPermission.directory(String dir) {
final escaped = dir.replaceAll(r'\', r'\\').replaceAll(r'/', r'\/');
final normalized = p.normalize(p.absolute(dir));
final escaped = normalized.replaceAll(r'\', r'\\').replaceAll(r'/', r'\/');
return FilesystemReadPermission(RegExp('^$escaped.*'));
}

/// Create a new filesystem permission that matches a specific file.
factory FilesystemReadPermission.file(String file) {
final escaped = file.replaceAll(r'\', r'\\').replaceAll(r'/', r'\/');
final normalized = p.normalize(p.absolute(file));
final escaped = normalized.replaceAll(r'\', r'\\').replaceAll(r'/', r'\/');
return FilesystemReadPermission(RegExp('^$escaped\$'));
}

Expand Down Expand Up @@ -104,13 +109,15 @@ class FilesystemWritePermission extends FilesystemPermission {
/// Create a new filesystem permission that matches any file in a directory
/// or one of its subdirectories.
factory FilesystemWritePermission.directory(String dir) {
final escaped = dir.replaceAll(r'\', r'\\').replaceAll(r'/', r'\/');
final normalized = p.normalize(p.absolute(dir));
final escaped = normalized.replaceAll(r'\', r'\\').replaceAll(r'/', r'\/');
return FilesystemWritePermission(RegExp('^$escaped.*'));
}

/// Create a new filesystem permission that matches a specific file.
factory FilesystemWritePermission.file(String file) {
final escaped = file.replaceAll(r'\', r'\\').replaceAll(r'/', r'\/');
final normalized = p.normalize(p.absolute(file));
final escaped = normalized.replaceAll(r'\', r'\\').replaceAll(r'/', r'\/');
return FilesystemWritePermission(RegExp('^$escaped\$'));
}

Expand Down