Details
-
Improvement
-
Status: Closed
-
Trivial
-
Resolution: Fixed
-
2.0-beta-6
-
None
-
None
-
Patch
Description
site-stage takes the distribution URL and builds a filesystem path from it. This can potentially lead to invalid paths since URLs may contain characters that are not valid for directory names.
It's mostly a theoretical issue since good URLs don't include bad characters. The only exploit I can offer is to set the distribution URL to something like file://G:/Sites/ on a Windows box which then will cause an invalid file name like G:\Sites\stage\localhost\G:\Sites\multi-module-project\index.html. I experienced this during some local quick&dirty testing.