From d73311945610417a1ebc7bb0723ced0a599594b4 Mon Sep 17 00:00:00 2001 From: Sam Atkins Date: Wed, 24 Apr 2024 11:44:52 +0100 Subject: [PATCH] fix: Make PathCommandProvider reject queries with path separators `../bin/foo` should only find `foo` relative to the current working directory, not to directories in PATH. Also switch to using the Node path library since PathCommandProvider is Node-only, and this means getting the correct path separator and delimiter values on Windows. --- .../src/puter-shell/providers/PathCommandProvider.js | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/packages/phoenix/src/puter-shell/providers/PathCommandProvider.js b/packages/phoenix/src/puter-shell/providers/PathCommandProvider.js index bf84a0526..0f17e3a6e 100644 --- a/packages/phoenix/src/puter-shell/providers/PathCommandProvider.js +++ b/packages/phoenix/src/puter-shell/providers/PathCommandProvider.js @@ -16,7 +16,7 @@ * You should have received a copy of the GNU Affero General Public License * along with this program. If not, see . */ -import path_ from "path-browserify"; +import path_ from "node:path"; import child_process from "node:child_process"; import stream from "node:stream"; import { signals } from '../../ansi-shell/signals.js'; @@ -167,9 +167,9 @@ function makeCommand(id, executablePath) { async function findCommandsInPath(id, ctx, firstOnly) { const PATH = ctx.env['PATH']; - if (!PATH) + if (!PATH || id.includes(path_.sep)) return; - const pathDirectories = PATH.split(':'); + const pathDirectories = PATH.split(path_.delimiter); const results = [];