fix bug atmos vendor pull URI cannot contain path traversal sequences and git schema

examples/tests/test-vendor/atmos.yaml

@@ -0,0 +1,40 @@
+base_path: "./"
+
+components:
+  terraform:
+    base_path: "components/terraform"
+    apply_auto_approve: false
+    deploy_run_init: true
+    init_run_reconfigure: true
+    auto_generate_backend_file: false
+
+stacks:
+  base_path: "stacks"
+  included_paths:
+    - "deploy/**/*"
+  excluded_paths:
+    - "**/_defaults.yaml"
+  name_pattern: "{stage}"
+
+vendor:  
+  # Single file
+  base_path: "./vendor.yaml"
+
+  # Directory with multiple files
+  #base_path: "./vendor"
+
+  # Absolute path
+  #base_path: "vendor.d/vendor1.yaml"
+
+logs:
+  file: "/dev/stderr"
+  level: Info
+
+# Custom CLI commands
+
+# No arguments or flags are required
+commands:
+- name: "test"
+  description: "Run all tests"
+  steps:
+  - atmos vendor pull --everything

examples/tests/test-vendor/test-components/README.md

@@ -0,0 +1,13 @@
+# Example Terraform IPinfo Component
+
+This Terraform module retrieves data from the IPinfo API for a specified IP address. If no IP address is specified, it retrieves data for the requester's IP address.
+
+## Usage
+
+### Inputs
+
+- `ip_address` (optional): The IP address to retrieve information for. If not specified, the requester's IP address will be used. The default value is an empty string.
+
+### Outputs
+
+- `metadata`: The data retrieved from IPinfo for the specified IP address, in JSON format.

examples/tests/test-vendor/test-components/main.tf

@@ -0,0 +1,7 @@
+data "http" "ipinfo" {
+  url = var.ip_address != "" ? "https://ipinfo.io/${var.ip_address}" : "https://ipinfo.io"
+
+  request_headers = {
+    Accept = "application/json"
+  }
+}

examples/tests/test-vendor/test-components/outputs.tf

@@ -0,0 +1,4 @@
+output "metadata" {
+  description = "The data retrieved from IPinfo for the specified IP address"
+  value       = jsondecode(data.http.ipinfo.response_body)
+}

examples/tests/test-vendor/test-components/providers.tf

@@ -0,0 +1 @@
+provider "http" {}

examples/tests/test-vendor/test-components/variables.tf

@@ -0,0 +1,5 @@
+variable "ip_address" {
+  description = "The IP address to retrieve information for (optional)"
+  type        = string
+  default     = ""
+}

examples/tests/test-vendor/test-components/versions.tf

@@ -0,0 +1,5 @@
+terraform {
+  required_version = ">= 1.0.0"
+
+  required_providers {}
+}

examples/tests/test-vendor/vendor.yaml

@@ -0,0 +1,43 @@
+apiVersion: atmos/v1
+kind: AtmosVendorConfig
+metadata:
+  name: demo-vendoring
+  description: Atmos vendoring manifest for Atmos demo component library
+spec:
+  # Import other vendor manifests, if necessary
+  imports: []
+
+  sources:
+    - component: "github/stargazers"
+      source: "github.com/cloudposse/atmos.git//examples/demo-library/{{ .Component }}?ref={{.Version}}"
+      version: "main"
+      targets:
+        - "components/terraform/{{ .Component }}/{{.Version}}"
+      included_paths:
+        - "**/*.tf"
+        - "**/*.tfvars"
+        - "**/*.md"
+      tags:
+        - demo
+        - github
+
+    - component: "test-components"
+      source: "file:///./test-components"
+      version: "main"
+      targets:
+        - "components/terraform/{{ .Component }}/{{.Version}}"
+      tags:
+        - demo
+
+    - component: "weather"
+      source: "git::https://github.com/cloudposse/atmos.git//examples/demo-library/{{ .Component }}?ref={{.Version}}"
+      version: "main"
+      targets:
+        - "components/terraform/{{ .Component }}/{{.Version}}"
+      tags:
+        - demo
+    - component: "my-vpc1"
+      source: "oci://public.ecr.aws/cloudposse/components/terraform/stable/aws/vpc:{{.Version}}"
+      version: "latest"
+      targets:
+        - "components/terraform/infra/my-vpc1"

internal/exec/vendor_component_utils.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"net/url"
 	"os"
 	"path/filepath"
 	"strings"
@@ -248,6 +249,14 @@ func ExecuteComponentVendorInternal(
 				sourceIsLocalFile = true
 			}
 		}
+		u, err := url.Parse(uri)
+		if err == nil && u.Scheme != "" {
+			if u.Scheme == "file" {
+				trimmedPath := strings.TrimPrefix(filepath.ToSlash(u.Path), "/")
+				uri = filepath.Clean(trimmedPath)
+				useLocalFileSystem = true
+			}
+		}
 	}
 
 	var pType pkgType

internal/exec/vendor_model.go

@@ -248,7 +248,7 @@ func downloadAndInstall(p *pkgAtmosVendor, dryRun bool, atmosConfig schema.Atmos
 			}
 		}
 		// Create temp directory
-		tempDir, err := os.MkdirTemp("", fmt.Sprintf("atmos-vendor-%d-*", time.Now().Unix()))
+		tempDir, err := os.MkdirTemp("", "atmos-vendor")
 		if err != nil {
 			return installedPkgMsg{
 				err:  fmt.Errorf("failed to create temp directory: %w", err),

internal/exec/vendor_utils.go

@@ -2,6 +2,7 @@ package exec
 
 import (
 	"fmt"
+	"net/url"
 	"os"
 	"path/filepath"
 	"sort"
@@ -384,7 +385,7 @@ func ExecuteAtmosVendorInternal(
 			if err != nil {
 				return err
 			}
-			targetPath := filepath.Join(vendorConfigFilePath, target)
+			targetPath := filepath.Join(filepath.ToSlash(vendorConfigFilePath), filepath.ToSlash(target))
 			pkgName := s.Component
 			if pkgName == "" {
 				pkgName = uri
@@ -514,12 +515,22 @@ func determineSourceType(uri *string, vendorConfigFilePath string) (bool, bool,
 	useLocalFileSystem := false
 	sourceIsLocalFile := false
 	if !useOciScheme {
-		if absPath, err := u.JoinAbsolutePathWithPath(vendorConfigFilePath, *uri); err == nil {
+		if absPath, err := u.JoinAbsolutePathWithPath(filepath.ToSlash(vendorConfigFilePath), *uri); err == nil {
 			uri = &absPath
 			useLocalFileSystem = true
 			sourceIsLocalFile = u.FileExists(*uri)
 		}
+		u, err := url.Parse(*uri)
+		if err == nil && u.Scheme != "" {
+			if u.Scheme == "file" {
+				trimmedPath := strings.TrimPrefix(filepath.ToSlash(u.Path), "/")
+				*uri = filepath.Clean(trimmedPath)
+				useLocalFileSystem = true
+			}
+		}
+
 	}
+
 	return useOciScheme, useLocalFileSystem, sourceIsLocalFile
 }
 
@@ -556,6 +567,8 @@ func generateSkipFunction(atmosConfig schema.AtmosConfiguration, tempDir string,
 		if filepath.Base(src) == ".git" {
 			return true, nil
 		}
+		tempDir = filepath.ToSlash(tempDir)
+		src = filepath.ToSlash(src)
 
 		trimmedSrc := u.TrimBasePathFromPath(tempDir+"/", src)
 
@@ -608,3 +621,19 @@ func generateSkipFunction(atmosConfig schema.AtmosConfiguration, tempDir string,
 		return false, nil
 	}
 }
+
+func validateURI(uri string) error {
+	if uri == "" {
+		return fmt.Errorf("URI cannot be empty")
+	}
+	if strings.Contains(uri, " ") {
+		return fmt.Errorf("URI cannot contain spaces")
+	}
+	// Validate scheme-specific format
+	if strings.HasPrefix(uri, "oci://") {
+		if !strings.Contains(uri[6:], "/") {
+			return fmt.Errorf("invalid OCI URI format")
+		}
+	}
+	return nil
+}

tests/cli_test.go

@@ -5,6 +5,8 @@ import (
 	"errors"
 	"flag"
 	"fmt"
+	"io"
+	"log"
 	"os"
 	"os/exec"
 	"path/filepath" // For resolving absolute paths
@@ -84,7 +86,13 @@ func (m *MatchPattern) UnmarshalYAML(value *yaml.Node) error {
 }
 
 func loadTestSuite(filePath string) (*TestSuite, error) {
-	data, err := os.ReadFile(filePath)
+	// Open the file
+	f, err := os.Open(filePath)
+	if err != nil {
+		log.Fatalf("Failed to open file: %v", err)
+	}
+	defer f.Close()
+	data, err := io.ReadAll(f)
 	if err != nil {
 		return nil, err
 	}
@@ -449,6 +457,76 @@ func TestCLICommands(t *testing.T) {
 		// Run with `t.Run` for non-TTY tests
 		t.Run(tc.Name, func(t *testing.T) {
 			runCLICommandTest(t, tc)
+			defer func() {
+				// Change back to the original working directory after the test
+				if err := os.Chdir(startingDir); err != nil {
+					t.Fatalf("Failed to change back to the starting directory: %v", err)
+				}
+			}()
+
+			// Change to the specified working directory
+			if tc.Workdir != "" {
+				err := os.Chdir(tc.Workdir)
+				if err != nil {
+					t.Fatalf("Failed to change directory to %q: %v", tc.Workdir, err)
+				}
+			}
+
+			// Check if the binary exists
+			binaryPath, err := exec.LookPath(tc.Command)
+			if err != nil {
+				t.Fatalf("Binary not found: %s. Current PATH: %s", tc.Command, pathManager.GetPath())
+			}
+
+			// Prepare the command
+			cmd := exec.Command(binaryPath, tc.Args...)
+
+			// Set environment variables
+			envVars := os.Environ()
+			for key, value := range tc.Env {
+				envVars = append(envVars, fmt.Sprintf("%s=%s", key, value))
+			}
+			cmd.Env = envVars
+
+			var stdout, stderr bytes.Buffer
+			cmd.Stdout = &stdout
+			cmd.Stderr = &stderr
+
+			// Run the command
+			err = cmd.Run()
+
+			// Validate exit code
+			exitCode := 0
+			if err != nil {
+				if exitErr, ok := err.(*exec.ExitError); ok {
+					exitCode = exitErr.ExitCode()
+				}
+			}
+			if exitCode != tc.Expect.ExitCode {
+				t.Errorf("Description: %s", tc.Description)
+				t.Errorf("Reason: Expected exit code %d, got %d", tc.Expect.ExitCode, exitCode)
+				t.Errorf("error: %v", cmd.Stderr)
+			}
+
+			// Validate stdout
+			if !verifyOutput(t, "stdout", stdout.String(), tc.Expect.Stdout) {
+				t.Errorf("Description: %s", tc.Description)
+			}
+
+			// Validate stderr
+			if !verifyOutput(t, "stderr", stderr.String(), tc.Expect.Stderr) {
+				t.Errorf("Description: %s", tc.Description)
+			}
+
+			// Validate file existence
+			if !verifyFileExists(t, tc.Expect.FileExists) {
+				t.Errorf("Description: %s", tc.Description)
+			}
+
+			// Validate file contents
+			if !verifyFileContains(t, tc.Expect.FileContains) {
+				t.Errorf("Description: %s", tc.Description)
+			}
 		})
 	}
 }
@@ -512,12 +590,17 @@ func verifyOutput(t *testing.T, outputType, output string, patterns []MatchPatte
 	}
 	return success
 }
-
 func verifyFileExists(t *testing.T, files []string) bool {
 	success := true
 	for _, file := range files {
-		if _, err := os.Stat(file); errors.Is(err, os.ErrNotExist) {
-			t.Errorf("Reason: Expected file does not exist: %q", file)
+		fileAbs, err := filepath.Abs(file)
+		if err != nil {
+			log.Println(err)
+			return false
+		}
+
+		if _, err := os.Stat(fileAbs); errors.Is(err, os.ErrNotExist) {
+			t.Errorf("Reason: Expected file does not exist: %q", fileAbs)
 			success = false
 		}
 	}
@@ -527,7 +610,13 @@ func verifyFileExists(t *testing.T, files []string) bool {
 func verifyFileContains(t *testing.T, filePatterns map[string][]MatchPattern) bool {
 	success := true
 	for file, patterns := range filePatterns {
-		content, err := os.ReadFile(file)
+		// Open the file
+		f, err := os.Open(file)
+		if err != nil {
+			log.Fatalf("Failed to open file: %v", err)
+		}
+		defer f.Close()
+		content, err := io.ReadAll(f)
 		if err != nil {
 			t.Errorf("Reason: Failed to read file %q: %v", file, err)
 			success = false

tests/fixtures/scenarios/complete/vendor.yaml

@@ -45,7 +45,7 @@ spec:
         - test
         - networking
     - component: "vpc-flow-logs-bucket"
-      source: "github.com/cloudposse/terraform-aws-components.git//modules/vpc-flow-logs-bucket?ref={{.Version}}"
+      source: "git::https://github.com/cloudposse/terraform-aws-components.git//modules/vpc-flow-logs-bucket?ref={{.Version}}"
       version: "1.323.0"
       targets:
         - "components/terraform/infra/vpc-flow-logs-bucket/{{.Version}}"