From 52f30bbad0290d2ce8b0332e98a53f98cd5a9275 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C4=90o=C3=A0n=20Tr=E1=BA=A7n=20C=C3=B4ng=20Danh?=
 <congdanhqx+sgn@gmail.com>
Date: Sun, 17 May 2020 18:42:43 +0700
Subject: [PATCH 1/2] xbps-src: pre-pkg: allow only white-listed directories.

---
 common/hooks/pre-pkg/99-pkglint.sh | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/common/hooks/pre-pkg/99-pkglint.sh b/common/hooks/pre-pkg/99-pkglint.sh
index d2c281e39db..bee6df56394 100644
--- a/common/hooks/pre-pkg/99-pkglint.sh
+++ b/common/hooks/pre-pkg/99-pkglint.sh
@@ -21,13 +21,37 @@ hook() {
 		fi
 	done
 	
-	for f in sys dev home root run var/run tmp usr/local destdir; do
+	for f in var/run usr/local; do
 		if [ -d ${PKGDESTDIR}/${f} ]; then
 			msg_red "${pkgver}: /${f} directory is not allowed, remove it!\n"
 			error=1
 		fi
 	done
 
+	for f in "$PKGDESTDIR"/*; do
+		f="${f##*/}"
+		case "$f" in
+		'*')	# The filename is exactly '*'
+			if [ -e "${PKGDESTDIR}/*" ]; then
+				msg_red "${pkgver}: File /${f} is not allowed\n"
+				error=1
+			fi
+			# Empty meta package is fine
+			;;
+		lib|bin|sbin|lib64|lib32|usr|var|opt|etc|boot|srv) ;;
+		INSTALL|INSTALL.msg|REMOVE|REMOVE.msg|rdeps|shlib-requires|shlib-provides)
+			if [ ! -f "${PKGDESTDIR}/$f" ]; then
+				msg_red "${pkgver}: /${f} is not allowed\n"
+				error=1
+			fi
+			;;
+		*)
+			msg_red "${pkgver}: /${f} directory is not allowed, remove it!\n"
+			error=1
+			;;
+		esac
+	done
+
 	# Check that configuration files really exist.
 	for f in $(expand_destdir "${conf_files}"); do
 		if [ ! -f "${PKGDESTDIR}/${f}" ]; then

From 5113f7fc5479d9bb28aa600ac7bd3a866357c107 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C4=90o=C3=A0n=20Tr=E1=BA=A7n=20C=C3=B4ng=20Danh?=
 <congdanhqx+sgn@gmail.com>
Date: Wed, 20 May 2020 06:12:02 +0700
Subject: [PATCH 2/2] fixup! xbps-src: pre-pkg: allow only white-listed
 directories.

---
 common/hooks/pre-pkg/99-pkglint.sh | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/common/hooks/pre-pkg/99-pkglint.sh b/common/hooks/pre-pkg/99-pkglint.sh
index bee6df56394..245cf90e43e 100644
--- a/common/hooks/pre-pkg/99-pkglint.sh
+++ b/common/hooks/pre-pkg/99-pkglint.sh
@@ -3,6 +3,7 @@
 hook() {
 	local error=0 filename= rev= libname= conflictPkg= conflictFile=
 	local conflictRev= ignore= found= mapshlibs=$XBPS_COMMONDIR/shlibs
+	local emptypkg=yes
 
 	set +E
 
@@ -36,9 +37,10 @@ hook() {
 				msg_red "${pkgver}: File /${f} is not allowed\n"
 				error=1
 			fi
-			# Empty meta package is fine
 			;;
-		lib|bin|sbin|lib64|lib32|usr|var|opt|etc|boot|srv) ;;
+		lib|bin|sbin|lib64|lib32|usr|var|opt|etc|boot|srv)
+			emptypkg=no
+			;;
 		INSTALL|INSTALL.msg|REMOVE|REMOVE.msg|rdeps|shlib-requires|shlib-provides)
 			if [ ! -f "${PKGDESTDIR}/$f" ]; then
 				msg_red "${pkgver}: /${f} is not allowed\n"
@@ -52,6 +54,12 @@ hook() {
 		esac
 	done
 
+	if [ "$build_style" != meta -a "$emptypkg" = yes ]; then
+		# Forbid empty packages unless build_style=meta
+		msg_red "${pkgver}: PKGDESTDIR is empty and build_style != meta\n"
+		error=1
+	fi
+
 	# Check that configuration files really exist.
 	for f in $(expand_destdir "${conf_files}"); do
 		if [ ! -f "${PKGDESTDIR}/${f}" ]; then
@@ -113,14 +121,6 @@ hook() {
 		fi
 	done
 
-	# Forbid empty packages unless build_style=meta
-	if [ "$build_style" != "meta" ]; then
-		if [ "$(find $PKGDESTDIR/* -maxdepth 1 -type d 2>/dev/null)" = "" ]; then
-			msg_red "${pkgver}: PKGDESTDIR is empty and build_style != meta\n"
-			error=1
-		fi
-	fi
-
 	if [ $error -gt 0 ]; then
 		msg_error "${pkgver}: cannot continue with installation!\n"
 	fi