Skip to content

fix: reject parent directory template locators#5054

Open
immanuwell wants to merge 1 commit into
lima-vm:masterfrom
immanuwell:fix-template-parent-locator
Open

fix: reject parent directory template locators#5054
immanuwell wants to merge 1 commit into
lima-vm:masterfrom
immanuwell:fix-template-parent-locator

Conversation

@immanuwell
Copy link
Copy Markdown

@immanuwell immanuwell commented May 27, 2026

It fixes tiny edge case

base: .. slipped past the parent-dir check because it only looked for ../. That lets limactl template copy absolutize it to the parent of the template dir.

Repro on main:

tmpdir=$(mktemp -d)
printf "base: ..\n" > "$tmpdir/template.yaml"
limactl template copy "$tmpdir/template.yaml" -

This prints a parent path instead of rejecting it. now it errors, same vibe as ../base.yaml.

Tests:

go test ./...

Signed-off-by: immanuwell <pchpr.00@list.ru>
@immanuwell immanuwell force-pushed the fix-template-parent-locator branch from cf88ee2 to ca747c5 Compare May 27, 2026 08:20
Comment thread pkg/limatmpl/abs.go
return "", errors.New("can't use relative paths when reading template from STDIN")
case strings.Contains(locator, "../"):
case containsParentDir(locator):
return "", fmt.Errorf("relative locator path %q must not contain '../' segments", locator)
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, this is a good improvement. Please also update the error message to match:

Suggested change
return "", fmt.Errorf("relative locator path %q must not contain '../' segments", locator)
return "", fmt.Errorf("relative locator path %q must not contain '..' path segments", locator)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants