diff options
| author | Saikari <[email protected]> | 2026-07-10 23:20:32 +0300 |
|---|---|---|
| committer | ruki <[email protected]> | 2026-07-30 10:17:31 +0800 |
| commit | dc0f11050075a727c68546b656e57c1d98a71022 (patch) | |
| tree | eb72138251a61ccc9fc0ee6d2454650e4f4205e5 | |
| parent | 4b6a2eb23d0903124871f837798db2dd718e86a1 (diff) | |
fix: improve cache key generation and validate plugin names for removal
| -rw-r--r-- | xmake/modules/private/action/require/impl/repository.lua | 7 | ||||
| -rw-r--r-- | xmake/plugins/plugin/main.lua | 2 |
2 files changed, 8 insertions, 1 deletions
diff --git a/xmake/modules/private/action/require/impl/repository.lua b/xmake/modules/private/action/require/impl/repository.lua index e2ac794df..9d150cb06 100644 --- a/xmake/modules/private/action/require/impl/repository.lua +++ b/xmake/modules/private/action/require/impl/repository.lua @@ -190,7 +190,12 @@ function packagedir(packagename, opt) -- get cache key local reponame = opt.name - local cachekey = packagename .. (opt.kind or "") + local cachekey = packagename + if opt.kind then + -- use a separator that cannot appear in package names to avoid key collision, + -- e.g. package("helloplugin") and plugin("hello") + cachekey = cachekey .. "\0" .. opt.kind + end local locked_repo = opt.locked_repo if locked_repo then cachekey = cachekey .. locked_repo.url .. (locked_repo.commit or "") .. (locked_repo.branch or "") diff --git a/xmake/plugins/plugin/main.lua b/xmake/plugins/plugin/main.lua index 1ab4d1a9e..4045fb053 100644 --- a/xmake/plugins/plugin/main.lua +++ b/xmake/plugins/plugin/main.lua @@ -201,6 +201,8 @@ end -- remove the given installed plugin function _remove() local name = assert(option.get("plugins"), "please specify the plugin name to be removed!") + -- avoid escaping the plugins directory, e.g. `xmake plugin --remove ../foo` + assert(not name:find("..", 1, true) and not name:find("[/\\:]"), "invalid plugin name(%s)!", name) local plugindir = path.join(global.directory(), "plugins", name) assert(os.isdir(plugindir), "plugin(%s) not found!", name) os.rmdir(plugindir) |