Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

.. category #7326

Closed
baconpaul opened this issue Nov 22, 2023 · 1 comment · Fixed by #7329
Closed

.. category #7326

baconpaul opened this issue Nov 22, 2023 · 1 comment · Fixed by #7329
Labels
Bug Report Item submitted using the Bug Report template Patch Browser
Milestone

Comments

@baconpaul
Copy link
Collaborator

..\ (repeated) can be used in the Category when saving patches, to write anywhere in the User area. On Windows, I get an error if I try to navigate up further, so at least user-level security in the OS is working. I'm not sure how other target OSs might behave (Linux, macOS, etc).

From j5v

@baconpaul baconpaul added the Bug Report Item submitted using the Bug Report template label Nov 22, 2023
@baconpaul baconpaul added this to the Surge XT 1.3 milestone Nov 22, 2023
@baconpaul
Copy link
Collaborator Author

baconpaul commented Nov 22, 2023

#include <filesystem>
#include <iostream>

int main(int, char **)
{
   auto p = std::filesystem::path{"/foo/bar/hootie"};
   auto ps = p/"this"/"that";
   auto psu = ps / "..";
   auto psu3 = ps / ".." / ".." / "..";

   std::cout << "P = " << p.u8string() << std::endl;

   for (const auto &vs : {p, ps, psu, psu3} )
   {
      std::cout << "  vs = " << vs.u8string() << std::endl;
      std::cout << "       a : " << vs.lexically_normal().u8string() << std::endl;
      std::cout << "       b : " << p.lexically_relative(vs.lexically_normal()).u8string() << std::endl;

      auto qt = vs.lexically_normal();
      auto [a, b] = std::mismatch(qt.begin(), qt.end(), p.begin(), p.end());
      std::cout << "       c : " << (a == qt.end() ? "AEND" : "AOK" ) << " " << (b == p.end() ? "BEND" : "BOK") << std::endl;
   }

}

if (b != p.end()) that means that the directory is not below p.

baconpaul added a commit to baconpaul/surge that referenced this issue Nov 22, 2023
If you add enough .. in your category, you end up outside of
the patches directory. Lets do a check to avoid that. But
patch subdirs and .. still work. so category of "test/foo/../bar" works
just "test/../../../../etc/root" does not

Closes surge-synthesizer#7326
baconpaul added a commit that referenced this issue Nov 22, 2023
If you add enough .. in your category, you end up outside of
the patches directory. Lets do a check to avoid that. But
patch subdirs and .. still work. so category of "test/foo/../bar" works
just "test/../../../../etc/root" does not

Closes #7326
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bug Report Item submitted using the Bug Report template Patch Browser
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants