From a5bb5e1e747ceb7b5a9defb6b1a8d9282a6e0957 Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@ubuntu.com>
Date: Tue, 8 Jul 2014 15:11:14 +0200
Subject: Only allow "apt-get build-dep path" when path starts with ./ or /

This avoid the subtle problem that someone might have a directory
with the same package name as the build-depends he/she is trying
to fetch. Also print a note that the specific file/dir is used.
---
 apt-pkg/contrib/strutl.cc               | 7 +++++++
 apt-pkg/contrib/strutl.h                | 1 +
 cmdline/apt-get.cc                      | 9 +++++++--
 test/integration/test-apt-get-build-dep | 3 +++
 test/libapt/strutil_test.cc             | 9 +++++++++
 5 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/apt-pkg/contrib/strutl.cc b/apt-pkg/contrib/strutl.cc
index 0f48860b1..7948673dc 100644
--- a/apt-pkg/contrib/strutl.cc
+++ b/apt-pkg/contrib/strutl.cc
@@ -62,6 +62,13 @@ bool Endswith(const std::string &s, const std::string &end)
    return (s.substr(s.size() - end.size(), s.size()) == end);
 }
 
+bool Startswith(const std::string &s, const std::string &start)
+{
+   if (start.size() > s.size())
+      return false;
+   return (s.substr(0, start.size()) == start);
+}
+
 }
 }
 									/*}}}*/
diff --git a/apt-pkg/contrib/strutl.h b/apt-pkg/contrib/strutl.h
index 5733fd6e2..da8bebdb5 100644
--- a/apt-pkg/contrib/strutl.h
+++ b/apt-pkg/contrib/strutl.h
@@ -40,6 +40,7 @@ namespace APT {
    namespace String {
       std::string Strip(const std::string &s);
       bool Endswith(const std::string &s, const std::string &ending);
+      bool Startswith(const std::string &s, const std::string &starting);
    }
 }
 
diff --git a/cmdline/apt-get.cc b/cmdline/apt-get.cc
index bd866bc8c..cdbfa4708 100644
--- a/cmdline/apt-get.cc
+++ b/cmdline/apt-get.cc
@@ -1065,9 +1065,12 @@ static bool DoBuildDep(CommandLine &CmdL)
       string Src;
       pkgSrcRecords::Parser *Last = 0;
 
-      // a unpacked debian source tree
-      if (DirectoryExists(*I))
+      // an unpacked debian source tree
+      using APT::String::Startswith;
+      if ((Startswith(*I, "./") || Startswith(*I, "/")) &&
+          DirectoryExists(*I))
       {
+         ioprintf(c1out, _("Note, using directory '%s' to get the build dependencies\n"), *I);
          // FIXME: how can we make this more elegant?
          std::string TypeName = "debian/control File Source Index";
          pkgIndexFile::Type *Type = pkgIndexFile::Type::GetType(TypeName.c_str());
@@ -1077,6 +1080,8 @@ static bool DoBuildDep(CommandLine &CmdL)
       // if its a local file (e.g. .dsc) use this
       else if (FileExists(*I))
       {
+         ioprintf(c1out, _("Note, using file '%s' to get the build dependencies\n"), *I);
+
          // see if we can get a parser for this pkgIndexFile type
          string TypeName = flExtension(*I) + " File Source Index";
          pkgIndexFile::Type *Type = pkgIndexFile::Type::GetType(TypeName.c_str());
diff --git a/test/integration/test-apt-get-build-dep b/test/integration/test-apt-get-build-dep
index f71beae9c..87ec6e54d 100755
--- a/test/integration/test-apt-get-build-dep
+++ b/test/integration/test-apt-get-build-dep
@@ -34,6 +34,7 @@ EOF
 
 testequal "Reading package lists...
 Building dependency tree...
+Note, using file '2vcard_0.5-3.dsc' to get the build dependencies
 The following NEW packages will be installed:
   build-essential debhelper
 0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.
@@ -76,6 +77,7 @@ EOF
 
 testequal "Reading package lists...
 Building dependency tree...
+Note, using file '2vcard_0.5-3.dsc' to get the build dependencies
 The following NEW packages will be installed:
   build-essential debhelper
 0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.
@@ -117,6 +119,7 @@ EOF
 
 testequal "Reading package lists...
 Building dependency tree...
+Note, using directory './foo-1.0' to get the build dependencies
 The following NEW packages will be installed:
   build-essential debhelper
 0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.
diff --git a/test/libapt/strutil_test.cc b/test/libapt/strutil_test.cc
index e9b778c6b..1c2f0abac 100644
--- a/test/libapt/strutil_test.cc
+++ b/test/libapt/strutil_test.cc
@@ -70,6 +70,15 @@ TEST(StrUtilTest,EndsWith)
    EXPECT_FALSE(Endswith("abcd", "x"));
    EXPECT_FALSE(Endswith("abcd", "abcndefg"));
 }
+TEST(StrUtilTest,StartWith)
+{
+   using APT::String::Startswith;
+   EXPECT_TRUE(Startswith("abcd", "a"));
+   EXPECT_TRUE(Startswith("abcd", "ab"));
+   EXPECT_TRUE(Startswith("abcd", "abcd"));
+   EXPECT_FALSE(Startswith("abcd", "x"));
+   EXPECT_FALSE(Startswith("abcd", "abcndefg"));
+}
 TEST(StrUtilTest,SubstVar)
 {
    EXPECT_EQ("", SubstVar("", "fails", "passes"));
-- 
cgit v1.2.3