From 22fa683571d98b59ea16e5fe48ac411c67939653 Mon Sep 17 00:00:00 2001
From: James Stronz <j.a.stronz@gmail.com>
Date: Sat, 16 Jul 2022 15:01:04 -0700
Subject: [PATCH] CVE-2022-35861: Fixed relative path traversal due to using
 version string in path (#2412)

---
 libexec/pyenv-version-file-read | 13 ++++++++++---
 test/version-file-read.bats     | 12 ++++++++++++
 2 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/libexec/pyenv-version-file-read b/libexec/pyenv-version-file-read
index 5dcc40fc..faaf1596 100755
--- a/libexec/pyenv-version-file-read
+++ b/libexec/pyenv-version-file-read
@@ -11,9 +11,16 @@ if [ -s "$VERSION_FILE" ]; then
   IFS="${IFS}"$'\r'
   sep=
   while read -n 1024 -r version _ || [[ $version ]]; do
-      [[ -z $version || $version == \#* ]] && continue
-      printf "%s%s" "$sep" "$version"
-      sep=:
+    if [[ -z $version || $version == \#* ]]; then
+      # Skip empty lines and comments
+      continue
+    elif [ "$version" = ".." ] || [[ $version == */* ]]; then
+      # The version string is used to construct a path and we skip dubious values.
+      # This prevents issues such as path traversal (CVE-2022-35861).
+      continue
+    fi
+    printf "%s%s" "$sep" "$version"
+    sep=:
   done <"$VERSION_FILE"
   [[ $sep ]] && { echo; exit; }
 fi
diff --git a/test/version-file-read.bats b/test/version-file-read.bats
index a7b184de..18cfe131 100644
--- a/test/version-file-read.bats
+++ b/test/version-file-read.bats
@@ -82,3 +82,15 @@ IN
   run pyenv-version-file-read my-version
   assert_success "3.9.3:3.8.9:2.7.16"
 }
+
+@test "skips relative path traversal" {
+  cat > my-version <<IN
+3.9.3
+3.8.9
+  ..
+./*
+2.7.16
+IN
+  run pyenv-version-file-read my-version
+  assert_success "3.9.3:3.8.9:2.7.16"
+}