diff --git a/ethers-etherscan/src/source_tree.rs b/ethers-etherscan/src/source_tree.rs index f8bf0826..16619621 100644 --- a/ethers-etherscan/src/source_tree.rs +++ b/ethers-etherscan/src/source_tree.rs @@ -37,10 +37,13 @@ impl SourceTree { /// Remove any components in a smart contract source path that could cause a directory traversal. fn sanitize_path(path: &Path) -> PathBuf { - Path::new(path) + let sanitized = Path::new(path) .components() .filter(|x| x.as_os_str() != Component::ParentDir.as_os_str()) - .collect::() + .collect::(); + + // Force absolute paths to be relative + sanitized.strip_prefix("/").map(PathBuf::from).unwrap_or(sanitized) } #[cfg(test)] @@ -81,14 +84,19 @@ mod tests { path: PathBuf::from("../b/../b.sol"), contents: String::from("Test 2"), }, + SourceTreeEntry { + path: PathBuf::from("/c/c.sol"), + contents: String::from("Test 3"), + }, ], }; st.write_to(tempdir.path()).unwrap(); let written_paths = read_dir(tempdir.path()).unwrap(); let paths: Vec = written_paths.into_iter().filter_map(|x| x.ok()).map(|x| x.path()).collect(); - assert_eq!(paths.len(), 2); + assert_eq!(paths.len(), 3); assert!(paths.contains(&tempdir.path().join("a"))); assert!(paths.contains(&tempdir.path().join("b"))); + assert!(paths.contains(&tempdir.path().join("c"))); } }