paweld/lazarus
1
0
Fork 0
mirror of https://gitlab.com/freepascal.org/lazarus/lazarus.git synced 2025-04-05 09:18:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

LazUtils/TryCreateRelativePath: Improved checking for double period (indicating parent folder) in paths

Browse Source
This commit is contained in:
n7800 2025-01-20 01:28:10 +05:00 committed by Juha Manninen
parent 0bb0a0625a
commit 170c75784c
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
components/lazutils/lazfileutils.inc
View File

@ -217,7 +217,7 @@ end;
is not threadsafe (at least on Windows platform)
- Dest and Source must either be both absolute filenames, or relative
- Dest and Source cannot contain '..' since no expanding is done by design
- Dest and Source cannot contain '/../' since no expanding is done by design
- Dest and Source must be on same drive or UNC path (Windows)
- if both Dest and Source are relative they must at least share their base directory
- Double PathDelims are ignored (unless they are part of the UNC convention)
@ -298,7 +298,10 @@ var
begin
Result := False;
if (Dest = '') or (Source = '') then Exit;
if (Pos('..',Dest) > 0) or (Pos('..',Source) > 0) then Exit;
// double period components (meaning parent directory) are not allowed in input
if Pos('/../', '/' + SwitchPathDelims(Source, pdsUnix) + '/') > 0 then Exit;
if Pos('/../', '/' + SwitchPathDelims(Dest , pdsUnix) + '/') > 0 then Exit;
SourceRoot := ExtractFileRoot(Source);
DestRoot := ExtractFileRoot(Dest);
//debugln('TryCreaterelativePath: DestRoot = "',DestRoot,'"');