Prevent using paths outside of the project directory
- Dominant language
- Go
- Stars
- 0
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
#### Steps to reproduce the issue
1. Create `./project-dir/project.yaml`:
```yaml
apiVersion: g2a-cli/v2.0
kind: Project
name: example-project
files:
- '../*.yaml'
```
2. Create `./service.yaml`:
```yaml
apiVersion: g2a-cli/v2.0
kind: Service
name: example-service
```
3. Go to `./project-dir` and run `build` command.
#### What's the expected result?
```
Loading file: /Users/qzb/Workspace/g2a-com/klio-lifecycle/examples/project-dir/project.yaml
Loading file: /Users/qzb/Workspace/g2a-com/klio-lifecycle/examples/service.yaml
File "/Users/qzb/Workspace/g2a-com/klio-lifecycle/examples/service.yaml" cannot be loaded, it is placed outside of the project directory
```
#### What's the actual result?
```
Loading file: /Users/qzb/Workspace/g2a-com/klio-lifecycle/examples/project-dir/project.yaml
Loading file: /Users/qzb/Workspace/g2a-com/klio-lifecycle/examples/service.yaml
No artifacts to build
Successfully built 1 service
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the build command and its handling of the project.yaml files pattern, using the reproduction with ../*.yaml as the first test case. Trace how matched paths are resolved and loaded. Done means files outside the project directory are rejected with an error and the build does not include them.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100