mustache.java
mustache.java copied to clipboard
Current directory check does not work with symbolic links
https://github.com/spullara/mustache.java/blob/a1197f7789b24d694f16dad29f917e9be43f0dc2/compiler/src/main/java/com/github/mustachejava/resolver/FileSystemResolver.java#L45
The line above gets the canonical path of the file and this check will break when "file" is a symbolic link .
My example:
- file abs: /local/asdf/_env/asdf-swit1na.18021267.375759313.1848829265/static-content/templates/asdf.html.mustache
- parent abs: /local/asdf/package/local_1/Generic/asdf/asdf-441.0-0/static-content/templates/asdf html.mustache
- checkRoot abs: /local/asdf/_env/asdf-swit1na.18021267.375759313.1848829265
And under directory: /local/apollo/_env/asdf-swit1na.18021267.375759313.1848829265
- static-content -> ../../package/local_1/Generic/asdf/asdf-441.0-0/static-content
Hmmm. I'll take a look if there is another way to safely check that they aren't escaping the root.