local:// sanitzes path now

1 files changed, 8 insertions, 9 deletions

diff --git a/src/helsinki.at/rhimport/fetcher.go b/src/helsinki.at/rhimport/fetcher.go
index 38e1d7f..fed51bf 100644
--- a/src/helsinki.at/rhimport/fetcher.go
+++ b/src/helsinki.at/rhimport/fetcher.go
@@ -32,6 +32,7 @@ import (
 	"net/url"
 	"os"
 	"path"
+	"path/filepath"
 	"strings"
 )
 
@@ -129,19 +130,18 @@ func FetchFileCurl(ctx *ImportContext, uri *url.URL) (err error) {
 	return
 }
 
-// TODO: check path to import from -> don't touch problematic files like /etc/shadow...
-//       the daemon shouldn't be running as a user who can do any harm anyway
-//       still: let's make a special configurable directory the local:/// dir
-//              and only allow absolute paths here which will be based on the
-//              'local' directory
-// TODO: also check if file exists and is accessable!!! otherwise curl will blow up
-//       with a not-easy-to-understand error
 func FetchFileLocal(ctx *ImportContext, uri *url.URL) (err error) {
 	rhl.Printf("Local fetcher called for '%s'", ctx.SourceUri)
 	if ctx.ProgressCallBack != nil {
 		ctx.ProgressCallBack(1, "fetching", 1.0, ctx.ProgressCallBackData)
 	}
-	ctx.SourceFile = uri.Path
+
+	ctx.SourceFile = filepath.Join(ctx.Config.LocalFetchDir, path.Clean("/"+uri.Path))
+	var src *os.File
+	if src, err = os.Open(ctx.SourceFile); err != nil {
+		return
+	}
+	defer src.Close()
 	ctx.DeleteSourceFile = false
 	ctx.DeleteSourceDir = false
 	return
@@ -182,7 +182,6 @@ func fetcher_init() {
 	}
 }
 
-// TODO: make sure a (partially) fetched file get's deleted on error
 func FetchFile(ctx *ImportContext) (err error) {
 
 	var uri *url.URL