mirror of
https://github.com/anchore/syft.git
synced 2026-11-04 08:26:38 +01:00
fix: don't split real paths on !/ in LocalPath and ContainerPath
`LocalPath` searched `FullNestedPath()` for the last `!/`, which is just `RealPath` for a file not in an archive. A host file like `/data/Hello!/world.txt` came back as `/world.txt`, so lookups and exclusions ran against the wrong path even with nested cataloging off. `ContainerPath` had the same problem when `FullPath` was set to `RealPath`. Both now cut `RealPath` off first and only look for a separator in the entry chain after it, which can't contain `!/` since entry names with it are refused. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
This commit is contained in:
@@ -32,6 +32,9 @@ func TestContainerPath(t *testing.T) {
|
||||
assert.Equal(t, "", ContainerPath(file.NewCoordinates("/app.war", "")))
|
||||
assert.Equal(t, "", ContainerPath(file.Coordinates{RealPath: "/app.war", FullPath: "/app.war"}), "a top-level file whose FullPath is set")
|
||||
assert.Equal(t, "", ContainerPath(file.Coordinates{RealPath: "/odd!/name"}), "a separator in a top-level real path is not an archive boundary")
|
||||
assert.Equal(t, "", ContainerPath(file.Coordinates{RealPath: "/odd!/name", FullPath: "/odd!/name"}), "nor when FullPath is set")
|
||||
assert.Equal(t, "/odd!/name.zip", ContainerPath(locationIn("/odd!/name.zip", "a.txt").Coordinates))
|
||||
assert.Equal(t, "/odd!/name.zip!/b.jar", ContainerPath(locationIn("/odd!/name.zip", "b.jar!/a.txt").Coordinates))
|
||||
assert.Equal(t, "/app.war", ContainerPath(locationIn("/app.war", "WEB-INF/lib/dep.jar").Coordinates))
|
||||
assert.Equal(t, "/app.war!/WEB-INF/lib/dep.jar",
|
||||
ContainerPath(locationIn("/app.war", "WEB-INF/lib/dep.jar!/META-INF/MANIFEST.MF").Coordinates))
|
||||
|
||||
Reference in New Issue
Block a user