osfs: In BoundOS, empty baseDir disables bound checks

This aligns the behaviour with chroot, as per use in go-git's default loader.

Signed-off-by: Paulo Gomes <[email protected]>

Author: pjbgf

osfs/os_bound.go

@@ -287,8 +287,7 @@ func (fs *BoundOS) insideBaseDir(filename string) (bool, error) {
 // a dir that is within the fs.baseDir, by first evaluating any symlinks
 // that either filename or fs.baseDir may contain.
 func (fs *BoundOS) insideBaseDirEval(filename string) (bool, error) {
-	// "/" contains all others.
-	if fs.baseDir == "/" || fs.baseDir == filename {
+	if fs.baseDir == "/" || fs.baseDir == "" || fs.baseDir == filename {
 		return true, nil
 	}
 	dir, err := filepath.EvalSymlinks(filepath.Dir(filename))

osfs/os_bound_test.go

@@ -1133,10 +1133,16 @@ func TestReadDir(t *testing.T) {
 
 func TestInsideBaseDirEval(t *testing.T) {
 	assert := assert.New(t)
+
 	fs := BoundOS{baseDir: "/"}
 	b, err := fs.insideBaseDirEval("a")
 	assert.True(b)
 	assert.Nil(err)
+
+	fs = BoundOS{baseDir: ""}
+	b, err = fs.insideBaseDirEval(filepath.Join("a", "b", "c"))
+	assert.True(b)
+	assert.Nil(err)
 }
 
 func TestMkdirAll(t *testing.T) {

osfs/os_windows.go

@@ -52,7 +52,7 @@ func rename(from, to string) error {
 	return os.Rename(from, to)
 }
 
-func umask(new int) func() {
+func umask(_ int) func() {
 	return func() {
 	}
 }