Do not use absolute path for .up dir in xpkg - Githubissues

upbound / up

The @upbound CLI

Apache License 2.0

52 stars 41 forks source link

Do not use absolute path for .up dir in xpkg #190

Closed hasheddan closed 2 years ago

hasheddan commented 2 years ago

Description of your changes

Updates the .up dir to not be absolute to avoid security concerns when extracting from an archive.

Signed-off-by: hasheddan georgedanielmangum@gmail.com

I have:

[x] Read and followed Upbound's contribution process.
[x] Run make reviewable to ensure this PR is ready for review.
[ ] Added backport release-x.y labels to auto-backport this PR, as appropriate.

How has this code been tested

Built a package with examples and pushed it, verified that they were extracted correctly:

🤖 (xpkg-luop) up xpkg build
🤖 (xpkg-luop) ls
composition.yaml  crossplane.yaml  definition.yaml  examples  luop-171d7f5d3a2a.xpkg
🤖 (xpkg-luop) up xpkg push xpkg.upbound.io/dan/luop:v0.0.2