#39 Allow runner.temp directory

Author: danielpalme

dist/index.js

@@ -65,7 +65,7 @@ function run() {
             const workspace = process.env.GITHUB_WORKSPACE || process.cwd();
             const resolvedToolpath = path.resolve(workspace, toolpath);
             try {
-                (0, sanitize_1.assertWithinWorkspace)(resolvedToolpath, 'toolpath', workspace);
+                (0, sanitize_1.assertWithinWorkspaceOrTempDirectory)(resolvedToolpath, 'toolpath', workspace);
             }
             catch (_a) {
                 core.setFailed(`'toolpath' resolves outside the workspace: ${resolvedToolpath}`);
@@ -269,23 +269,25 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.assertWithinWorkspace = assertWithinWorkspace;
+exports.assertWithinWorkspaceOrTempDirectory = assertWithinWorkspaceOrTempDirectory;
 exports.assertPathsWithinWorkspace = assertPathsWithinWorkspace;
 exports.validateCustomSetting = validateCustomSetting;
 const path = __importStar(__nccwpck_require__(6928));
-function assertWithinWorkspace(resolvedPath, inputName, workspace) {
+function assertWithinWorkspaceOrTempDirectory(resolvedPath, inputName, workspace) {
     const normalizedResolved = path.resolve(resolvedPath);
     const normalizedWorkspace = path.resolve(workspace);
-    if (normalizedResolved !== normalizedWorkspace
-        && !normalizedResolved.startsWith(normalizedWorkspace + path.sep)) {
-        throw new Error(`Input '${inputName}' resolves outside the workspace: ${resolvedPath}`);
+    const runnerTemp = process.env.RUNNER_TEMP;
+    const normalizedRunnerTemp = runnerTemp ? path.resolve(runnerTemp) : null;
+    if (!isWithinPath(normalizedResolved, normalizedWorkspace)
+        && !isWithinPath(normalizedResolved, normalizedRunnerTemp)) {
+        throw new Error(`Input '${inputName}' resolves outside the workspace and temp directory: ${resolvedPath}`);
     }
 }
 function assertPathsWithinWorkspace(value, inputName, workspace) {
     value.split(/[;]/).forEach(segment => {
         const trimmed = segment.trim();
         if (trimmed.length > 0) {
-            assertWithinWorkspace(path.resolve(workspace, trimmed), inputName, workspace);
+            assertWithinWorkspaceOrTempDirectory(path.resolve(workspace, trimmed), inputName, workspace);
         }
     });
 }
@@ -299,6 +301,12 @@ function validateCustomSetting(setting) {
     }
     return trimmed;
 }
+function isWithinPath(normalizedPath, normalizedTargetPath) {
+    if (normalizedPath === null || normalizedTargetPath === null) {
+        return false;
+    }
+    return normalizedPath === normalizedTargetPath || normalizedPath.startsWith(normalizedTargetPath + path.sep);
+}
 
 
 /***/ }),

src/reportgenerator.ts

@@ -2,7 +2,7 @@ import * as core from '@actions/core';
 import * as exec from '@actions/exec';
 import * as fs from 'fs';
 import * as path from 'path';
-import { assertPathsWithinWorkspace, assertWithinWorkspace, validateCustomSetting } from './sanitize';
+import { assertPathsWithinWorkspace, assertWithinWorkspaceOrTempDirectory, validateCustomSetting } from './sanitize';
 
 const VERSION = '5.5.5';
 
@@ -16,7 +16,7 @@ async function run() {
     const workspace = process.env.GITHUB_WORKSPACE || process.cwd();
     const resolvedToolpath = path.resolve(workspace, toolpath);
     try {
-      assertWithinWorkspace(resolvedToolpath, 'toolpath', workspace);
+      assertWithinWorkspaceOrTempDirectory(resolvedToolpath, 'toolpath', workspace);
     } catch {
       core.setFailed(`'toolpath' resolves outside the workspace: ${resolvedToolpath}`);
       return;

src/sanitize.ts

@@ -1,19 +1,23 @@
 import * as path from 'path';
 
-export function assertWithinWorkspace(resolvedPath: string, inputName: string, workspace: string): void {
+export function assertWithinWorkspaceOrTempDirectory(resolvedPath: string, inputName: string, workspace: string): void {
   const normalizedResolved = path.resolve(resolvedPath);
   const normalizedWorkspace = path.resolve(workspace);
-  if (normalizedResolved !== normalizedWorkspace
-      && !normalizedResolved.startsWith(normalizedWorkspace + path.sep)) {
-    throw new Error(`Input '${inputName}' resolves outside the workspace: ${resolvedPath}`);
+
+  const runnerTemp = process.env.RUNNER_TEMP;
+  const normalizedRunnerTemp = runnerTemp ? path.resolve(runnerTemp) : null;
+
+  if (!isWithinPath(normalizedResolved, normalizedWorkspace)
+    && !isWithinPath(normalizedResolved, normalizedRunnerTemp)) {
+    throw new Error(`Input '${inputName}' resolves outside the workspace and temp directory: ${resolvedPath}`);
   }
 }
 
 export function assertPathsWithinWorkspace(value: string, inputName: string, workspace: string): void {
   value.split(/[;]/).forEach(segment => {
     const trimmed = segment.trim();
     if (trimmed.length > 0) {
-      assertWithinWorkspace(path.resolve(workspace, trimmed), inputName, workspace);
+      assertWithinWorkspaceOrTempDirectory(path.resolve(workspace, trimmed), inputName, workspace);
     }
   });
 }
@@ -30,3 +34,11 @@ export function validateCustomSetting(setting: string): string | null {
 
   return trimmed;
 }
+
+function isWithinPath(normalizedPath: string|null, normalizedTargetPath: string|null): boolean {
+  if (normalizedPath === null || normalizedTargetPath === null) {
+    return false;
+  }
+
+  return normalizedPath === normalizedTargetPath || normalizedPath.startsWith(normalizedTargetPath + path.sep);
+}

tsconfig.json

@@ -46,7 +46,7 @@
     // "paths": {},                           /* A series of entries which re-map imports to lookup locations relative to the 'baseUrl'. */
     // "rootDirs": [],                        /* List of root folders whose combined content represents the structure of the project at runtime. */
     // "typeRoots": [],                       /* List of folders to include type definitions from. */
-    // "types": [],                           /* Type declaration files to be included in compilation. */
+    "types": ["node"],                           /* Type declaration files to be included in compilation. */
     // "allowSyntheticDefaultImports": true,  /* Allow default imports from modules with no default export. This does not affect code emit, just typechecking. */
     "esModuleInterop": true                   /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */
     // "preserveSymlinks": true,              /* Do not resolve the real path of symlinks. */