Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion internal/shared/clients.go
Original file line number Diff line number Diff line change
Expand Up @@ -222,7 +222,12 @@ func (c *ClientFactory) InitSDKConfig(ctx context.Context, dirPath string) error
return slackerror.New(slackerror.ErrHooksJSONLocation)
}
// Move upward one directory level
dirPath = filepath.Dir(dirPath)
parentDir := filepath.Dir(dirPath)
if parentDir == dirPath {
// Reached a filesystem root not covered above (e.g. D:\ when SYSTEMROOT is on C:\)
return slackerror.New(slackerror.ErrHooksJSONLocation)
}
dirPath = parentDir
}
configFileBytes, err := afero.ReadFile(c.Fs, hooksJSONFilePath)
if err != nil {
Expand Down
6 changes: 6 additions & 0 deletions internal/shared/clients_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -110,6 +110,12 @@ func Test_ClientFactory_InitSDKConfig(t *testing.T) {
mockWorkingDirectory: filepath.Join("path", "outside", "home", "to", "project"),
expectedError: slackerror.New(slackerror.ErrHooksJSONLocation),
},
"errors if traversal reaches a filesystem root": {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice add 🙏

mockHooksJSONContent: "{}",
mockHooksJSONFilePath: filepath.Join(string(filepath.Separator), "other", "volume", "project", "package.json"),
mockWorkingDirectory: filepath.Join(string(filepath.Separator), "other", "volume", "project"),
expectedError: slackerror.New(slackerror.ErrHooksJSONLocation),
},
}
for name, tc := range tests {
t.Run(name, func(t *testing.T) {
Expand Down
Loading