Module returns a billy.Filesystem pointing to the module folder. As a defence in depth against submodule name path traversal, refuse names whose joined path leaves the modules/ subtree once cleaned. The config-layer parser also validates submodule names, but Module may be reached from any caller th
(name string)
| 1139 | // but Module may be reached from any caller that constructs a |
| 1140 | // Submodule struct programmatically and so bypasses the parser. |
| 1141 | func (d *DotGit) Module(name string) (billy.Filesystem, error) { |
| 1142 | p := d.fs.Join(modulePath, name) |
| 1143 | cleaned := path.Clean(filepath.ToSlash(p)) |
| 1144 | if cleaned != modulePath && !strings.HasPrefix(cleaned, modulePath+"/") { |
| 1145 | return nil, ErrModuleNameEscape |
| 1146 | } |
| 1147 | return d.fs.Chroot(p) |
| 1148 | } |
| 1149 | |
| 1150 | func (d *DotGit) AddAlternate(remote string) error { |
| 1151 | altpath := d.fs.Join(objectsPath, infoPath, alternatesPath) |