Merge pull request #1048 from mojavelinux/issue-690

resolve relative paths relative to base_dir in unsafe mode

2 files changed, 26 insertions, 7 deletions

diff --git a/lib/asciidoctor/abstract_node.rb b/lib/asciidoctor/abstract_node.rb
index 10dfe419..ed8cc67b 100644
--- a/lib/asciidoctor/abstract_node.rb
+++ b/lib/asciidoctor/abstract_node.rb
@@ -452,14 +452,18 @@ class AbstractNode
   # Returns the [String] path resolved from the start and target paths, with any
   # parent references resolved and self references removed. If a jail is provided,
   # this path will be guaranteed to be contained within the jail.
-  def normalize_system_path(target, start = nil, jail = nil, opts = {})
-    if start.nil?
-      start = @document.base_dir
-    end
-    if jail.nil? && @document.safe >= SafeMode::SAFE
-      jail = @document.base_dir
+  def normalize_system_path target, start = nil, jail = nil, opts = {}
+    if (doc = @document).safe < SafeMode::SAFE
+      if start
+        start = ::File.join doc.base_dir, start unless (@path_resolver ||= PathResolver.new).is_root? start
+      else
+        start = doc.base_dir
+      end
+    else
+      start = doc.base_dir unless start
+      jail = doc.base_dir unless jail
     end
-    (@path_resolver ||= PathResolver.new).system_path(target, start, jail, opts)
+    (@path_resolver ||= PathResolver.new).system_path target, start, jail, opts
   end
 
   # Public: Normalize the asset file or directory to a concrete and rinsed path
diff --git a/test/paths_test.rb b/test/paths_test.rb
index ea7b0a5b..1503d30d 100644
--- a/test/paths_test.rb
+++ b/test/paths_test.rb
@@ -200,6 +200,21 @@ context 'Path Resolver' do
       assert_equal "#{JAIL}/part1/chapter1/section1.adoc", filename
       assert_equal 'part1/chapter1/section1.adoc', @resolver.relative_path(filename, JAIL)
     end
+
+    test 'should resolve relative path relative to base dir in unsafe mode' do
+      base_dir = fixture_path 'base'
+      doc = empty_document :base_dir => base_dir, :safe => Asciidoctor::SafeMode::UNSAFE
+      expected = ::File.join base_dir, 'images', 'tiger.png'
+      actual = doc.normalize_system_path 'tiger.png', 'images'
+      assert_equal expected, actual
+    end
+
+    test 'should resolve absolute path as absolute in unsafe mode' do
+      base_dir = fixture_path 'base'
+      doc = empty_document :base_dir => base_dir, :safe => Asciidoctor::SafeMode::UNSAFE
+      actual = doc.normalize_system_path 'tiger.png', '/etc/images'
+      assert_equal '/etc/images/tiger.png', actual
+    end
   end
 
   context 'Helpers' do