xiaoxiang781216 commented on code in PR #3718: URL: https://github.com/apache/nuttx-apps/pull/3718#discussion_r3789181717
########## system/nxpkg/pkg_manifest.c: ########## @@ -82,13 +82,7 @@ static bool pkg_validate_hex(FAR const char *value) * Name: pkg_validate_path_component * * Description: - * Reject any value that could escape the intended directory when spliced - * into a filesystem path (pkg_store.c's PKG_STORE_DIR "/%s/%s/..." - * formatters). This is required for "name" and "version" specifically, - * since both come straight from an untrusted, network-fetched - * index.json and are used unsanitized to build install paths - a - * version of "../../evil" would otherwise let a malicious index write - * or delete files outside the package store entirely. + * Check that a value is safe as one path component. Review Comment: squash into one patch -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
