avm platform-tools uninstall currently accepts arbitrary strings as platform-tools versions and passes them directly to PathBuf::join.
Inputs containing path traversal components (e.g. v1.54/../../../victim) resolve outside $AVM_HOME/platform-tools and are later passed to fs::remove_dir_all.
Expected behavior: Only valid platform-tools version identifiers should be accepted.
Suggested fix:
- Validate the version before path construction.
- Reject path separators and non-normal path components.
- Share the validation between install and uninstall.
- Add a regression test.
avm platform-tools uninstallcurrently accepts arbitrary strings as platform-tools versions and passes them directly toPathBuf::join.Inputs containing path traversal components (e.g.
v1.54/../../../victim) resolve outside$AVM_HOME/platform-toolsand are later passed tofs::remove_dir_all.Expected behavior: Only valid platform-tools version identifiers should be accepted.
Suggested fix: