The path in blueprint.write_files reaches a RUN chmod <mode> <path> line but is only checked for a leading /. A path like /tmp/x; touch /tmp/PWNED # injects a build-time command. Add a path regex (mirroring the existing shellRe), which also subsumes the leading-slash check, plus a rejection test. Found reviewing #1.
The path in blueprint.write_files reaches a
RUN chmod <mode> <path>line but is only checked for a leading/. A path like/tmp/x; touch /tmp/PWNED #injects a build-time command. Add a path regex (mirroring the existing shellRe), which also subsumes the leading-slash check, plus a rejection test. Found reviewing #1.