checkURI(): Check file URIs against allowedPaths

This makes e.g. 'fetchGit ./.' work (assuming that ./. is an allowed
path).

1 files changed, 12 insertions, 0 deletions

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 33a9bc614285..7775cbe53cc4 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -378,6 +378,18 @@ void EvalState::checkURI(const std::string & uri)
             && (prefix[prefix.size() - 1] == '/' || uri[prefix.size()] == '/')))
             return;
 
+    /* If the URI is a path, then check it against allowedPaths as
+       well. */
+    if (hasPrefix(uri, "/")) {
+        checkSourcePath(uri);
+        return;
+    }
+
+    if (hasPrefix(uri, "file://")) {
+        checkSourcePath(std::string(uri, 7));
+        return;
+    }
+
     throw RestrictedPathError("access to URI '%s' is forbidden in restricted mode", uri);
 }