Merge pull request #2078 from alixander/prevent-oob

fix oob
terrastruct · Aug 27, 2024 · e2e8878 · e2e8878
2 parents b6a9268 + e93a60d
commit e2e8878
Show file tree

Hide file tree

Showing 3 changed files with 129 additions and 0 deletions.
diff --git a/d2compiler/compile_test.go b/d2compiler/compile_test.go
@@ -2386,6 +2386,17 @@ layers: {
 				tassert.Equal(t, "root.layers.a", g.Layers[2].Layers[0].Objects[2].Link.Value)
 			},
 		},
+		{
+			name: "link-beyond-import-root",
+			text: `...@x`,
+			files: map[string]string{
+				"x.d2": `x.link: _.layers.z
+`,
+			},
+			assertions: func(t *testing.T, g *d2graph.Graph) {
+				tassert.Equal(t, (*d2graph.Scalar)(nil), g.Objects[0].Link)
+			},
+		},
 		{
 			name: "link-board-underscore-not-found",
 			text: `x

diff --git a/d2ir/compile.go b/d2ir/compile.go
@@ -904,6 +904,7 @@ func (c *compiler) ignoreLazyGlob(n Node) bool {
 func (c *compiler) extendLinks(m *Map, importF *Field, importDir string) {
 	nodeBoardKind := NodeBoardKind(m)
 	importIDA := IDA(importF)
+FIELDS_LOOP:
 	for _, f := range m.Fields {
 		if f.Name == "link" {
 			if nodeBoardKind != "" {
@@ -922,6 +923,9 @@ func (c *compiler) extendLinks(m *Map, importF *Field, importDir string) {
 
 			for _, id := range linkIDA[1:] {
 				if id == "_" {
+					if len(linkIDA) < 2 || len(importIDA) < 2 {
+						continue FIELDS_LOOP
+					}
 					linkIDA = append([]string{linkIDA[0]}, linkIDA[2:]...)
 					importIDA = importIDA[:len(importIDA)-2]
 				} else {

diff --git a/testdata/d2compiler/TestCompile/link-beyond-import-root.exp.json b/testdata/d2compiler/TestCompile/link-beyond-import-root.exp.json