Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

#1676 - Fixes file path validation in dotnet tool #1722

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
arturcic merged 1 commit into from
Aug 5, 2025
Merged

#1676 - Fixes file path validation in dotnet tool #1722

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions 2 .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,3 +33,5 @@ dist-ssr
.debug/

junit-report.xml

src/__tests__/test.env
4 changes: 2 additions & 2 deletions 4 dist/tools/libs/gitversion.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,7 +122,7 @@ class GitVersionTool extends DotnetTool {
builder.addArgument("/nonormalize");
}
if (configFilePath) {
if (await this.isValidInputFile("configFilePath", configFilePath)) {
if (await this.isValidInputFile(workDir, configFilePath)) {
builder.addArgument("/config").addArgument(configFilePath);
} else {
throw new Error(`GitVersion configuration file not found at ${configFilePath}`);
Expand All @@ -139,7 +139,7 @@ class GitVersionTool extends DotnetTool {
if (updateAssemblyInfo) {
builder.addArgument("/updateassemblyinfo");
if (updateAssemblyInfoFilename) {
if (await this.isValidInputFile("updateAssemblyInfoFilename", updateAssemblyInfoFilename)) {
if (await this.isValidInputFile(workDir, updateAssemblyInfoFilename)) {
builder.addArgument(updateAssemblyInfoFilename);
} else {
throw new Error(`AssemblyInfoFilename file not found at ${updateAssemblyInfoFilename}`);
Expand Down
2 changes: 1 addition & 1 deletion 2 dist/tools/libs/gitversion.mjs.map
View file
Open in desktop

Large diffs are not rendered by default.

19 changes: 12 additions & 7 deletions 19 dist/tools/libs/tools.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -293,13 +293,18 @@ class DotnetTool {
args = ["--roll-forward Major", ...args];
return await this.execute(toolPath, args);
}
async isValidInputFile(input, file) {
return this.filePathSupplied(input) && await this.buildAgent.fileExists(file);
}
filePathSupplied(file) {
const pathValue = path.resolve(this.buildAgent.getInput(file) || "");
const repoRoot = this.buildAgent.sourceDir;
return pathValue !== repoRoot;
async isValidInputFile(workDir, file) {
if (!file) {
this.buildAgent.debug("No file path supplied");
return false;
}
if (path.isAbsolute(file)) {
this.buildAgent.debug("File path is absolute");
return await this.buildAgent.fileExists(file);
}
const filePath = path.resolve(workDir, file);
this.buildAgent.debug(`Resolved file path: ${filePath}`);
return await this.buildAgent.fileExists(filePath);
}
async getRepoPath(targetPath) {
const srcDir = this.buildAgent.sourceDir || ".";
Expand Down
2 changes: 1 addition & 1 deletion 2 dist/tools/libs/tools.mjs.map
View file
Open in desktop

Large diffs are not rendered by default.

20 changes: 12 additions & 8 deletions 20 src/tools/common/dotnet-tool.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -200,14 +200,18 @@ export abstract class DotnetTool implements IDotnetTool {
return await this.execute(toolPath, args)
}

protected async isValidInputFile(input: string, file: string): Promise<boolean> {
return this.filePathSupplied(input) && (await this.buildAgent.fileExists(file))
}

protected filePathSupplied(file: string): boolean {
const pathValue = path.resolve(this.buildAgent.getInput(file) || '')
const repoRoot = this.buildAgent.sourceDir
return pathValue !== repoRoot
protected async isValidInputFile(workDir: string, file: string): Promise<boolean> {
if (!file) {
this.buildAgent.debug('No file path supplied')
return false
}
if (path.isAbsolute(file)) {
this.buildAgent.debug('File path is absolute')
return await this.buildAgent.fileExists(file)
}
const filePath = path.resolve(workDir, file)
this.buildAgent.debug(`Resolved file path: ${filePath}`)
return await this.buildAgent.fileExists(filePath)
}

protected async getRepoPath(targetPath: string): Promise<string> {
Expand Down
4 changes: 2 additions & 2 deletions 4 src/tools/gitversion/tool.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,7 +103,7 @@ export class GitVersionTool extends DotnetTool {
}

if (configFilePath) {
if (await this.isValidInputFile('configFilePath', configFilePath)) {
if (await this.isValidInputFile(workDir, configFilePath)) {
builder.addArgument('/config').addArgument(configFilePath)
} else {
throw new Error(`GitVersion configuration file not found at ${configFilePath}`)
Expand All @@ -124,7 +124,7 @@ export class GitVersionTool extends DotnetTool {

// You can specify 'updateAssemblyInfo' without 'updateAssemblyInfoFilename'.
if (updateAssemblyInfoFilename) {
if (await this.isValidInputFile('updateAssemblyInfoFilename', updateAssemblyInfoFilename)) {
if (await this.isValidInputFile(workDir, updateAssemblyInfoFilename)) {
builder.addArgument(updateAssemblyInfoFilename)
} else {
throw new Error(`AssemblyInfoFilename file not found at ${updateAssemblyInfoFilename}`)
Expand Down
Morty Proxy This is a proxified and sanitized view of the page, visit original site.