github · esbena · Aug 25, 2020 · Aug 7, 2020 · Aug 25, 2020 · Aug 25, 2020
@@ -310,7 +310,7 @@ test("API client used when reading remote config", async t => {
     const spyGetContents = mockGetContents(dummyResponse);
 
     // Create checkout directory for remote queries repository
-    fs.mkdirSync(path.join(tmpDir, 'foo/bar'), { recursive: true });
+    fs.mkdirSync(path.join(tmpDir, 'foo/bar/dev'), { recursive: true });
 
     setInput('config-file', 'octo-org/codeql-config/config.yaml@main');
     setInput('languages', 'javascript');

@@ -10,12 +10,13 @@ setupTests(test);
 
 test("checkoutExternalQueries", async t => {
   await util.withTmpDir(async tmpDir => {
+    const ref = "df4c6869212341b601005567381944ed90906b6b";
     await externalQueries.checkoutExternalRepository(
       "github/codeql-go",
-      "df4c6869212341b601005567381944ed90906b6b",
+      ref,
       tmpDir);
 
     // COPYRIGHT file existed in df4c6869212341b601005567381944ed90906b6b but not in the default branch
-    t.true(fs.existsSync(path.join(tmpDir, "github", "codeql-go", "COPYRIGHT")));
+    t.true(fs.existsSync(path.join(tmpDir, "github", "codeql-go", ref, "COPYRIGHT")));
   });
 });
@@ -9,7 +9,13 @@ import * as path from 'path';
 export async function checkoutExternalRepository(repository: string, ref: string, tempDir: string): Promise<string> {
   core.info('Checking out ' + repository);
 
-  const checkoutLocation = path.join(tempDir, repository);
+  const checkoutLocation = path.join(tempDir, repository, ref);
+
+  if (!checkoutLocation.startsWith(tempDir)) {
+    // this still permits locations that mess with sibling repositories in `tempDir`, but that is acceptable
+    throw new Error(`'${repository}@${ref}' is not a valid repository and reference.`);
+  }
+
   if (!fs.existsSync(checkoutLocation)) {
     const repoURL = 'https://github.com/' + repository + '.git';
     await exec.exec('git', ['clone', repoURL, checkoutLocation]);