From f24e726ba53e23235d33d8bdc7877ad3a8632fde Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 6 Feb 2018 14:35:14 +0100
Subject: checkURI(): Check file URIs against allowedPaths

This makes e.g. 'fetchGit ./.' work (assuming that ./. is an allowed
path).
---
 src/libexpr/eval.cc | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 33a9bc6142..7775cbe53c 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -378,6 +378,18 @@ void EvalState::checkURI(const std::string & uri)
             && (prefix[prefix.size() - 1] == '/' || uri[prefix.size()] == '/')))
             return;
 
+    /* If the URI is a path, then check it against allowedPaths as
+       well. */
+    if (hasPrefix(uri, "/")) {
+        checkSourcePath(uri);
+        return;
+    }
+
+    if (hasPrefix(uri, "file://")) {
+        checkSourcePath(std::string(uri, 7));
+        return;
+    }
+
     throw RestrictedPathError("access to URI '%s' is forbidden in restricted mode", uri);
 }
 
-- 
cgit 1.4.1