g2a-com / g2a-com/kikd

Prevent using paths outside of the project directory

Open
#8 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
0
Forks
3
PR merge metrics
No merged PRs in 30d

Description

#### Steps to reproduce the issue

1. Create `./project-dir/project.yaml`:

```yaml
apiVersion: g2a-cli/v2.0
kind: Project
name: example-project
files:
- '../*.yaml'
```

2. Create `./service.yaml`:

```yaml
apiVersion: g2a-cli/v2.0
kind: Service
name: example-service
```

3. Go to `./project-dir` and run `build` command.

#### What's the expected result?

```
Loading file: /Users/qzb/Workspace/g2a-com/klio-lifecycle/examples/project-dir/project.yaml
Loading file: /Users/qzb/Workspace/g2a-com/klio-lifecycle/examples/service.yaml
File "/Users/qzb/Workspace/g2a-com/klio-lifecycle/examples/service.yaml" cannot be loaded, it is placed outside of the project directory
```

#### What's the actual result?

```
Loading file: /Users/qzb/Workspace/g2a-com/klio-lifecycle/examples/project-dir/project.yaml
Loading file: /Users/qzb/Workspace/g2a-com/klio-lifecycle/examples/service.yaml
No artifacts to build
Successfully built 1 service
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the build command and its handling of the project.yaml files pattern, using the reproduction with ../*.yaml as the first test case. Trace how matched paths are resolved and loaded. Done means files outside the project directory are rejected with an error and the build does not include them.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.