Merge pull request #2787 from manyfold3d/fix-library-path-detect

Fix library path safety check

app/validators/safe_path_validator.rb

@@ -1,21 +1,24 @@
 class SafePathValidator < ActiveModel::EachValidator
   UNSAFE = [
-    "/bin",
-    "/boot",
-    "/dev",
-    "/etc",
-    "/lib",
-    "/lost",
-    "/proc",
-    "/root",
-    "/run",
-    "/sbin",
-    "/selinux",
-    "/srv",
-    "/usr"
+    nil,
+    "bin",
+    "boot",
+    "dev",
+    "etc",
+    "lib",
+    "lost",
+    "proc",
+    "root",
+    "run",
+    "sbin",
+    "selinux",
+    "srv",
+    "usr"
   ]
 
   def validate_each(record, attribute, value)
-    record.errors.add attribute, :unsafe if value === "/" || UNSAFE.any? { |x| value&.starts_with?(x) }
+    return if value.nil?
+    start = Pathname.new(value).each_filename.to_a.first
+    record.errors.add attribute, :unsafe if UNSAFE.any?(start)
   end
 end

spec/models/library_spec.rb

@@ -56,6 +56,12 @@
       end
     end
 
+    it "allows paths that *begin* with a filtered path" do
+      library = build(:library, path: "/libraries")
+      library.valid?
+      expect(library.errors[:path]).not_to include "cannot be a privileged system path"
+    end
+
     it "disallows root folder" do
       library = build(:library, path: "/")
       library.valid?