forked from heavy-duty/box
68a4996f0b
Round-1 convergence from all three reviewers, both findings real: A version string used to be a path fragment: 'box uninstall ../../../.ssh' resolved below versions/ and rm -rf'd wherever it landed, 'box use' could point current outside the root, and a hostile flat-tree VERSION could steer the migration's mv the same way. One strict validator now gates every caller — only [A-Za-z0-9._+-], no leading '.' or '-' — byte-identical in install.sh and bin/box like existing_boxes, diff-guarded in the tests, with traversal regressions on use, uninstall and the migration (which now refuses BEFORE the tree moves anywhere). --force is uninstall's installer-family consent, and --purge-host now forwards it: teardown-host.sh gets --yes under --force/BOX_YES, so the combined non-interactive uninstall no longer dies at teardown's own prompt. CI's drill now runs the combined verb with --force alone (no BOX_YES, no TTY) — the exact invocation that used to abort. Also grok's polish, taken: current flips by rename (ln to a side name, mv -Tf over — no window with no current) in both install.sh and 'box use'; BOX_REINSTALL swaps by two renames and deletes LAST; and the single-version path refuses while current is dangling (readlink -f resolves a missing last component, so the guard checks the DIRECTORY, not just the string). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| cli.sh | ||