From 1edc1a7ecc74798484b690db0f88b9ac30120162 Mon Sep 17 00:00:00 2001
From: "Jason A. Donenfeld" <Jason@zx2c4.com>
Date: Fri, 18 Apr 2014 13:22:39 +0200
Subject: Check sneaky paths.

---
 src/password-store.sh | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/src/password-store.sh b/src/password-store.sh
index f80f026..4874175 100755
--- a/src/password-store.sh
+++ b/src/password-store.sh
@@ -114,6 +114,14 @@ reencrypt_path() {
 		prev_gpg_recipients="${GPG_RECIPIENTS[@]}"
 	done
 }
+check_sneaky_paths() {
+	for path in "$@"; do
+		if [[ $path =~ /\.\.$ || $path =~ ^\.\./ || $path =~ /\.\./ || $path =~ ^\.\.$ ]]; then
+			echo "Error: You've attempted to pass a sneaky path to pass. Go home."
+			exit 1
+		fi
+	done
+}
 
 #
 # END helper functions
@@ -256,6 +264,7 @@ cmd_init() {
 		echo "Usage: $PROGRAM $COMMAND [--path=subfolder,-p subfolder] gpg-id..."
 		exit 1
 	fi
+	[[ -n $id_path ]] && check_sneaky_paths "$id_path"
 	if [[ -n $id_path && ! -d $PREFIX/$id_path ]]; then
 		if [[ -e $PREFIX/$id_path ]]; then
 			echo "Error: $PREFIX/$id_path exists but is not a directory."
@@ -309,6 +318,7 @@ cmd_show() {
 
 	local path="$1"
 	local passfile="$PREFIX/$path.gpg"
+	check_sneaky_paths "$path"
 	if [[ -f $passfile ]]; then
 		if [[ $clip -eq 0 ]]; then
 			exec $GPG -d $GPG_OPTS "$passfile"
@@ -396,6 +406,7 @@ cmd_insert() {
 	fi
 	local path="$1"
 	local passfile="$PREFIX/$path.gpg"
+	check_sneaky_paths "$path"
 
 	[[ $force -eq 0 && -e $passfile ]] && yesno "An entry already exists for $path. Overwrite it?"
 
@@ -436,6 +447,7 @@ cmd_edit() {
 	fi
 
 	local path="$1"
+	check_sneaky_paths "$path"
 	mkdir -p -v "$PREFIX/$(dirname "$path")"
 	set_gpg_recipients "$(dirname "$path")"
 	local passfile="$PREFIX/$path.gpg"
@@ -481,6 +493,7 @@ cmd_generate() {
 	fi
 	local path="$1"
 	local length="$2"
+	check_sneaky_paths "$path"
 	if [[ ! $length =~ ^[0-9]+$ ]]; then
 		echo "pass-length \"$length\" must be a number."
 		exit 1
@@ -522,6 +535,7 @@ cmd_delete() {
 		exit 1
 	fi
 	local path="$1"
+	check_sneaky_paths "$path"
 
 	local passfile="$PREFIX/${path%/}"
 	if [[ ! -d $passfile ]]; then
@@ -560,6 +574,7 @@ cmd_copy_move() {
 		echo "Usage: $PROGRAM $COMMAND [--force,-f] old-path new-path"
 		exit 1
 	fi
+	check_sneaky_paths "$@"
 	local old_path="$PREFIX/${1%/}"
 	local new_path="$PREFIX/$2"
 	local old_dir="$old_path"
-- 
cgit v1.2.3-59-g8ed1b