Prevent copying a directory into itself

[iwege]

fse.copy('src','src/dest') will create the dest continues to recurse, and finally it throws an error ENAMETOOLONG

It links to AvianFlu/ncp#4

[danyshaanan]

How does require('fs').copy handle this case?

[jprichardson]

Off the cuff, I'd say that I could just resolve the paths and check if one is a substring of the other. But I'd be concerned about introducing regressions. Thoughts?

[iwege]

I have collected some cases in this pr AvianFlu/ncp#61, maybe you can use it as a reference.

[jprichardson]

@lwege are you still interested in this getting fixed? I'd like to tackle this - it'd be awesome to take your list of cases and turn them into tests for both *nix and Windows.

[iwege]

@jimhigson I copied testcase to https://github.com/iwege/node-fs-extra/tree/feature/prevent-copy-to-self , but how can I test it first? Or do I need to fix this issue with my old code?

[jprichardson]

Would you link directly to the test case so that I can take a look? Thanks.

[iwege]

@jprichardson iwege@0dc1610

[jprichardson]

Thank you. Tests look good. Any thoughts on a reliable fix?

[iwege]

I have used the AvianFlu/ncp#61 in my project and no one reports relative issue to me. But I don't know it reliable or not. Maybe my user doesn't do this in my product.

[DaneEveritt]

Sorry to bring this back up, but any progress on implementing this, or should I add my own checks?

[jprichardson]

or should I add my own checks

What checks would you add?

[DaneEveritt]

I built off @iwege's changes, and made the following function that I'm using before I call the move function.

isSelf(moveTo, moveFrom) {
    const target = this.server.path(moveTo); // these two lines are simply building a path to the files
    const source = this.server.path(moveFrom);

    if (!_.startsWith(target, source)) {
        return false;
    }

    const end = target.slice(source.length);
    if (!end) {
        return true;
    }

    return _.startsWith(end, '/');
}

Prevents moving folders into themselves, but doesn't block moving a folder into another folder that starts with the same name (so src can still move into src-dest, but not into src).

Renaming files to the same name also triggers the catch, but that doesn't bother me so much.