Validate patch file paths.

pkg/analyzer/lib/src/generated/sdk.dart

 // Copyright (c) 2014, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 library analyzer.src.generated.sdk;
 
 import 'dart:collection';
 
 import 'package:analyzer/dart/ast/ast.dart';
 import 'package:analyzer/dart/ast/token.dart';
 import 'package:analyzer/dart/ast/visitor.dart';
 import 'package:analyzer/src/generated/engine.dart'
     show AnalysisContext, AnalysisOptions, AnalysisOptionsImpl;
 import 'package:analyzer/src/generated/source.dart' show Source;
 import 'package:analyzer/src/generated/utilities_general.dart';
 import 'package:analyzer/src/summary/idl.dart' show PackageBundle;
+import 'package:path/path.dart' as pathos;
 
 /**
  * A function used to create a new DartSdk with the given [options]. If the
  * passed [options] are `null`, then default options are used.
  */
 typedef DartSdk SdkCreator(AnalysisOptions options);
 
 /**
  * A Dart SDK installed in a specified location.
  */
@@ skipping 385 matching lines @@
             library.documented = (expression as BooleanLiteral).value;
           } else if (name == _PATCHES) {
             if (expression is MapLiteral) {
               expression.entries.forEach((MapLiteralEntry entry) {
                 int platforms = _convertPlatforms(entry.key);
                 Expression pathsListLiteral = entry.value;
                 if (pathsListLiteral is ListLiteral) {
                   List<String> paths = <String>[];
                   pathsListLiteral.elements.forEach((Expression pathExpr) {
                     if (pathExpr is SimpleStringLiteral) {
-                      paths.add(pathExpr.value);
+                      String path = pathExpr.value;
+                      _validatePatchPath(path);
+                      paths.add(path);
                     } else {
                       throw new ArgumentError(
                           'The "patch" argument items must be simple strings.');
                     }
                   });
                   library.setPatchPaths(platforms, paths);
                 } else {
                   throw new ArgumentError(
                       'The "patch" argument values must be list literals.');
                 }
@@ skipping 14 matching lines @@
             }
           }
         }
       }
       _librariesMap.setLibrary(libraryName, library);
     }
     return null;
   }
 
   /**
+   * Validate the given [path] to a patch file. Throw [ArgumentError] if not a
+   * valid path: is absolute, or contains `..`.
+   */
+  void _validatePatchPath(String path) {
+    if (path.contains(r'\')) {
+      throw new ArgumentError('The path to a patch file must be posix: $path');
+    }
+    if (pathos.isAbsolute(path)) {

[Paul Berry, 2016/10/11 16:57:51]

Use pathos.posix.isAbsolute() so that we don't get any surprises on Windows.

+      throw new ArgumentError(
+          'The path to a patch file cannot be absolute: $path');
+    }
+    if (path.contains('..')) {
+      throw new ArgumentError(
+          'The path to a patch file cannot contain "..": $path');
+    }
+  }
+
+  /**
    * Return the platform constant value for the given [expr].
    * Throw [ArgumentError] if not a valid platform name given.
    */
   static int _convertPlatform(Expression expr) {
     if (expr is SimpleIdentifier) {
       String name = expr.name;
       if (name == _DART2JS_PLATFORM) {
         return SdkLibraryImpl.DART2JS_PLATFORM;
       }
       if (name == _VM_PLATFORM) {
@@ skipping 196 matching lines @@
     _platformsToPatchPaths[platforms] = paths;
   }
 
   /**
    * Record that this library can be run on the VM.
    */
   void setVmLibrary() {
     _platforms |= VM_PLATFORM;
   }
 }