Harden package cache paths

2026-09-03 21:13:37 +02:00
parent 422b076f19
commit 943caba91c
1 changed files with 7 additions and 1 deletions
@@ -262,11 +262,17 @@ def _atomic_replace_file(source, target):


 def _package_cache_dir(target_dir, package_id):
+    safe_id = "".join(
+        ch if ch.isalnum() or ch in ("-", "_", ".") else "_"
+        for ch in str(package_id)
+    )
+    if safe_id in ("", ".", ".."):
+        raise RemotePackageError("Invalid package-cache ID.")
    return os.path.join(
        target_dir,
        ".modernization_tool",
        "package_cache",
-        str(package_id),
+        safe_id,
    )