Validate patch file paths.

pkg/analyzer/lib/src/generated/sdk.dart

Index: pkg/analyzer/lib/src/generated/sdk.dart
diff --git a/pkg/analyzer/lib/src/generated/sdk.dart b/pkg/analyzer/lib/src/generated/sdk.dart
index 7f78e556242df2ec082223024d5370b36ba3c203..dbdc03f71b585e74e02fcaac634562b34485c021 100644
--- a/pkg/analyzer/lib/src/generated/sdk.dart
+++ b/pkg/analyzer/lib/src/generated/sdk.dart
@@ -14,6 +14,7 @@ import 'package:analyzer/src/generated/engine.dart'
 import 'package:analyzer/src/generated/source.dart' show Source;
 import 'package:analyzer/src/generated/utilities_general.dart';
 import 'package:analyzer/src/summary/idl.dart' show PackageBundle;
+import 'package:path/path.dart' as pathos;
 
 /**
  * A function used to create a new DartSdk with the given [options]. If the
@@ -419,7 +420,9 @@ class SdkLibrariesReader_LibraryBuilder extends RecursiveAstVisitor<Object> {
                   List<String> paths = <String>[];
                   pathsListLiteral.elements.forEach((Expression pathExpr) {
                     if (pathExpr is SimpleStringLiteral) {
-                      paths.add(pathExpr.value);
+                      String path = pathExpr.value;
+                      _validatePatchPath(path);
+                      paths.add(path);
                     } else {
                       throw new ArgumentError(
                           'The "patch" argument items must be simple strings.');
@@ -454,6 +457,24 @@ class SdkLibrariesReader_LibraryBuilder extends RecursiveAstVisitor<Object> {
   }
 
   /**
+   * Validate the given [path] to a patch file. Throw [ArgumentError] if not a
+   * valid path: is absolute, or contains `..`.
+   */
+  void _validatePatchPath(String path) {
+    if (path.contains(r'\')) {
+      throw new ArgumentError('The path to a patch file must be posix: $path');
+    }
+    if (pathos.isAbsolute(path)) {

[Paul Berry, 2016/10/11 16:57:51]

Use pathos.posix.isAbsolute() so that we don't get any surprises on Windows.

+      throw new ArgumentError(
+          'The path to a patch file cannot be absolute: $path');
+    }
+    if (path.contains('..')) {
+      throw new ArgumentError(
+          'The path to a patch file cannot contain "..": $path');
+    }
+  }
+
+  /**
    * Return the platform constant value for the given [expr].
    * Throw [ArgumentError] if not a valid platform name given.
    */