fs: assert unsafe operations are run on safe paths only

1 files changed, 16 insertions, 6 deletions

diff --git a/lua/nvim-lsp-installer/fs.lua b/lua/nvim-lsp-installer/fs.lua
index 55809767..0cfaceca 100644
--- a/lua/nvim-lsp-installer/fs.lua
+++ b/lua/nvim-lsp-installer/fs.lua
@@ -1,7 +1,23 @@
+local pathm = require("nvim-lsp-installer.path")
+
 local uv = vim.loop
 local M = {}
 
+local function assert_ownership(path)
+    if not pathm.is_subdirectory(pathm.SERVERS_ROOT_DIR, path) then
+        error(("Refusing to operate on path outside of the servers root dir (%s)."):format(pathm.SERVERS_ROOT_DIR))
+    end
+end
+
+function M.rmrf(path)
+    assert_ownership(path)
+    if vim.fn.delete(path, "rf") ~= 0 then
+        error(("rmrf: Could not remove directory %q."):format(path))
+    end
+end
+
 function M.mkdirp(path)
+    assert_ownership(path)
     if vim.fn.mkdir(path, "p") ~= 1 then
         error(("mkdirp: Could not create directory %q."):format(path))
     end
@@ -28,10 +44,4 @@ function M.fstat(path)
     return assert(uv.fs_fstat(fd))
 end
 
-function M.rmrf(path)
-    if vim.fn.delete(path, "rf") ~= 0 then
-        error(("rmrf: Could not remove directory %q."):format(path))
-    end
-end
-
 return M