# package fetching: catch relative paths that resolve into cache dir · gitcafe/zig

[View on GitCafe](https://git.cafe/gitcafe/zig/commit/2a322645331532e22def160677a345854f00b7e2)

Repository: [gitcafe/zig](https://git.cafe/gitcafe/zig)

Visibility: public

Requested revision: 2a322645331532e22def160677a345854f00b7e2

Requested commit: 2a322645331532e22def160677a345854f00b7e2

Commit: 2a322645331532e22def160677a345854f00b7e2

Tree: b480cb4010b89a3c0bee1b27d1562b39fe09cb24

Author: Andrew Kelley

Committer: Andrew Kelley

## Message

```
package fetching: catch relative paths that resolve into cache dir

The logic here already caught the case when a dependency path tried to
escape out of the zig cache directory using up directories. However, it
did not catch the case when the relative path tried to reach into a
different path within the zig-cache. For example, if it asked for
"../../../blah" then it would be caught, but if it asked for "../blah"
then it would try to resolve as "zig-cache/p/blah" and probably result
in file-not-found, or perhaps resolve to a different package if someone
inadvertently used a valid package hash instead of "blah".

Now it correctly gives a "dependency path outside project" error,
however, still allows relative paths with up-dirs that were not fetched
via URL.

```

## Parents

- [a98d4a66e957f02e0beb91738ff59e989ad94028](https://git.cafe/gitcafe/zig/commit/a98d4a66e957f02e0beb91738ff59e989ad94028?format=markdown)

[Source at this commit](https://git.cafe/gitcafe/zig/tree/2a322645331532e22def160677a345854f00b7e2?format=markdown)