From dc0f11050075a727c68546b656e57c1d98a71022 Mon Sep 17 00:00:00 2001 From: Saikari Date: Fri, 10 Jul 2026 23:20:32 +0300 Subject: fix: improve cache key generation and validate plugin names for removal --- xmake/plugins/plugin/main.lua | 2 ++ 1 file changed, 2 insertions(+) (limited to 'xmake/plugins/plugin/main.lua') diff --git a/xmake/plugins/plugin/main.lua b/xmake/plugins/plugin/main.lua index 1ab4d1a9e..4045fb053 100644 --- a/xmake/plugins/plugin/main.lua +++ b/xmake/plugins/plugin/main.lua @@ -201,6 +201,8 @@ end -- remove the given installed plugin function _remove() local name = assert(option.get("plugins"), "please specify the plugin name to be removed!") + -- avoid escaping the plugins directory, e.g. `xmake plugin --remove ../foo` + assert(not name:find("..", 1, true) and not name:find("[/\\:]"), "invalid plugin name(%s)!", name) local plugindir = path.join(global.directory(), "plugins", name) assert(os.isdir(plugindir), "plugin(%s) not found!", name) os.rmdir(plugindir) -- cgit v1.3.1