Repository: scala-steward-org/scala-steward
Pull request #1991 (2021-03-03 16:14:31)

Ignore build roots that contain '..'
This should prevent exiting Scala Steward's workspace using build roots
that contain `..`.

codecov[bot]: # [Codecov](https://codecov.io/gh/scala-steward-org/scala-steward/pull/1991?src=pr&el=h1) Report
> Merging [#1991](https://codecov.io/gh/scala-steward-org/scala-steward/pull/1991?src=pr&el=desc) (8787163) into [master](https://codecov.io/gh/scala-steward-org/scala-steward/commit/d3e6006d3f50112fe6e46c70619679e51004fd80?el=desc) (d3e6006) will **not change** coverage.
> The diff coverage is `50.00%`.

[![Impacted file tree graph](https://codecov.io/gh/scala-steward-org/scala-steward/pull/1991/graphs/tree.svg?width=650&height=150&src=pr&token=udzMsc1Dne)](https://codecov.io/gh/scala-steward-org/scala-steward/pull/1991?src=pr&el=tree)

```diff
@@           Coverage Diff           @@
##           master    #1991   +/-   ##
=======================================
  Coverage   78.65%   78.65%           
=======================================
  Files         130      129    -1     
  Lines        2258     2258           
  Branches       52       57    +5     
=======================================
  Hits         1776     1776           
  Misses        482      482           
```


| [Impacted Files](https://codecov.io/gh/scala-steward-org/scala-steward/pull/1991?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [.../org/scalasteward/core/repoconfig/RepoConfig.scala](https://codecov.io/gh/scala-steward-org/scala-steward/pull/1991/diff?src=pr&el=tree#diff-bW9kdWxlcy9jb3JlL3NyYy9tYWluL3NjYWxhL29yZy9zY2FsYXN0ZXdhcmQvY29yZS9yZXBvY29uZmlnL1JlcG9Db25maWcuc2NhbGE=) | `94.73% <50.00%> (-5.27%)` | :arrow_down: |
| [...la-2.12/org/scalasteward/mill/plugin/package.scala](https://codecov.io/gh/scala-steward-org/scala-steward/pull/1991/diff?src=pr&el=tree#diff-bW9kdWxlcy9taWxsLXBsdWdpbi9zcmMvbWFpbi9zY2FsYS0yLjEyL29yZy9zY2FsYXN0ZXdhcmQvbWlsbC9wbHVnaW4vcGFja2FnZS5zY2FsYQ==) | | |

------

[Continue to review full report at Codecov](https://codecov.io/gh/scala-steward-org/scala-steward/pull/1991?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/scala-steward-org/scala-steward/pull/1991?src=pr&el=footer). Last update [d3e6006...8787163](https://codecov.io/gh/scala-steward-org/scala-steward/pull/1991?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).


Patch:
diff --git a/modules/core/src/main/scala/org/scalasteward/core/repoconfig/RepoConfig.scala b/modules/core/src/main/scala/org/scalasteward/core/repoconfig/RepoConfig.scala
index ceae14c2..d89484e0 100644
--- a/modules/core/src/main/scala/org/scalasteward/core/repoconfig/RepoConfig.scala
+++ b/modules/core/src/main/scala/org/scalasteward/core/repoconfig/RepoConfig.scala
@@ -31,7 +31,9 @@ final case class RepoConfig(
     buildRoots: Option[List[BuildRootConfig]] = None
 ) {
   def buildRootsOrDefault: List[BuildRootConfig] =
-    buildRoots.getOrElse(List(BuildRootConfig.repoRoot))
+    buildRoots
+      .map(_.filterNot(_.relativePath.contains("..")))
+      .getOrElse(List(BuildRootConfig.repoRoot))
 
   def updatePullRequestsOrDefault: PullRequestUpdateStrategy =
     updatePullRequests.getOrElse(PullRequestUpdateStrategy.default)


Test patch:
diff --git a/modules/core/src/test/scala/org/scalasteward/core/repoconfig/RepoConfigAlgTest.scala b/modules/core/src/test/scala/org/scalasteward/core/repoconfig/RepoConfigAlgTest.scala
index 118bf695..a2670a4b 100644
--- a/modules/core/src/test/scala/org/scalasteward/core/repoconfig/RepoConfigAlgTest.scala
+++ b/modules/core/src/test/scala/org/scalasteward/core/repoconfig/RepoConfigAlgTest.scala
@@ -200,6 +200,12 @@ class RepoConfigAlgTest extends FunSuite {
     assertEquals(config, Right(expected))
   }
 
+  test("build root with '..'") {
+    val content = """buildRoots = [ "../../../etc" ]"""
+    val config = RepoConfigAlg.parseRepoConfig(content).map(_.buildRootsOrDefault)
+    assertEquals(config, Right(Nil))
+  }
+
   test("malformed config") {
     val repo = Repo("fthomas", "scala-steward")
     val configFile = MockContext.config.workspace / "fthomas/scala-steward/.scala-steward.conf"