FileLoader::normalizePath() strips leading ../

[spaze]

First, thanks for making Latte! ☕

While migrating to Latte 2.4 I've find the following issue, if I do this in a presenter:

$this->createTemplate()->setFile('../../foo/bar.latte);

and there's

{include waldo.latte}

in bar.latte, rendering fails with

_RuntimeException: Missing template file foo/waldo.latte_

I've tracked it down to an issue in Latte\Loaders\FileLoader::normalizePath() where in the first foreach iteration when $res is still empty then if it hits $part === '..' condition then the $part is just thrown away because it tries to array_pop from an empty array.

The issue can be demonstrated by adding

Assert::same('../../tests', $loader->getReferredName('../tests', '../file'));

to Loaders.FileLoader.phpt.

Hope this is at least a bit understandable.

The workaround is to never pass leading ../ to setFile() (and use realpath() to remove these) but since I've already spent quite a while figuring out where's the problem, the proposed fix is an incoming pull request.

[OzzyCzech]

Have same problem after upgrade to 2.4

[dg]

$this->createTemplate()->setFile('../../foo/bar.latte); seems like code smell (i.e. relative paths are code smell), you should use absolute path.

[OzzyCzech]

I know (do not agree) but It should work - it's valid path and valid use case

[dg]

I agree that normalizePath should be fixed, but still I have to point out that using relative paths is a security problem and you should never use them :)

[spaze]

@dg Thanks! Why is that a problem?

[dg]

Because you never know against what it is relative.

[spaze]

Sure, it's always current directory which can be changed, of course. Maybe I just misunderstood what you said and thought you mean it always is a problem, sorry. It's clear now, thanks.

[spaze]

Just a side note, this discussion made me revisit my initial workaround for the original issue and realizing I'd need to work around it harder I've moved my files elsewhere, which made the code easier and solved the issue for me. So yeah, a happyend, thanks @dg :-)