spullara / spullara/mustache.java

Current directory check does not work with symbolic links

Open
#206 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
HTML
Stars
2k
Forks
281
PR merge metrics
No merged PRs in 30d

Description

https://github.com/spullara/mustache.java/blob/a1197f7789b24d694f16dad29f917e9be43f0dc2/compiler/src/main/java/com/github/mustachejava/resolver/FileSystemResolver.java#L45

The line above gets the canonical path of the file and this check will break when "file" is a symbolic link .

My example:

  • file abs: /local/asdf/_env/asdf-swit1na.18021267.375759313.1848829265/static-content/templates/asdf.html.mustache
  • parent abs: /local/asdf/package/local_1/Generic/asdf/asdf-441.0-0/static-content/templates/asdf html.mustache
  • checkRoot abs: /local/asdf/_env/asdf-swit1na.18021267.375759313.1848829265

And under directory: /local/apollo/_env/asdf-swit1na.18021267.375759313.1848829265

  • static-content -> ../../package/local_1/Generic/asdf/asdf-441.0-0/static-content

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in compiler/src/main/java/com/github/mustachejava/resolver/FileSystemResolver.java at line 45 and inspect how the current-directory check derives and compares canonical paths. Reproduce the check with the symbolic-link layout described in the issue; done means a valid symlinked file is accepted without weakening the intended root-directory boundary.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.