[jira] [Commented] (CB-5960) File API mishandles relative URLs that traverse directories above the FS root

["ASF subversion and git services (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/CB-5960?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13897232#comment-13897232 ] 

ASF subversion and git services commented on CB-5960:
-----------------------------------------------------

Commit 4ce92dff1b554b0a5d3a5e88bac2cf019f9266ae in branch refs/heads/master from [~iclelland]
[ https://git-wip-us.apache.org/repos/asf?p=cordova-plugin-file.git;h=4ce92df ]

CB-5960: ios: android: Properly handle parent references in getFile/getDirectory


> File API mishandles relative URLs that traverse directories above the FS root
> -----------------------------------------------------------------------------
>
>                 Key: CB-5960
>                 URL: https://issues.apache.org/jira/browse/CB-5960
>             Project: Apache Cordova
>          Issue Type: Bug
>            Reporter: Ian Clelland
>
> Filesystem URLs should not be able to use ".." path components to reach outside of their sandbox. From the File API, ".." relative to a path resolves to the paths parent directory, and the parent directory of the filesystem root is itself.
> So, if {{root}} is a DirectoryEntry representing the root of a filesystem, then
> {code}
> root.getFile("../file.txt", ...);
> {code}
> and
> {code}
> root.getFile("/file.txt", ...);
> {code}
> should resolve to the same file.
> {code}
> root.getDirectory("subdir_a/subdir_b", function(entry) {
>     entry.getFile("../file.txt", ...);
> }, ...);
> {code}
> should resolve to "/subdir_a/file.txt"



--
This message was sent by Atlassian JIRA
(v6.1.5#6160)