@@ -563,8 +563,16 @@ finalMsg noTrail s = if noTrail then Nothing else Just s
563563unpackThunk :: MonadObelisk m => FilePath -> m ()
564564unpackThunk = unpackThunk' False
565565
566+-- | Check that we are not somewhere inside the thunk directory
567+checkThunkDirectory :: MonadObelisk m => FilePath -> m ()
568+checkThunkDirectory thunkDir = do
569+ currentDir <- liftIO getCurrentDirectory
570+ thunkDir' <- liftIO $ canonicalizePath thunkDir
571+ when (thunkDir' `L.isInfixOf` currentDir) $
572+ failWith "Can't pack/unpack from within the thunk directory"
573+
566574unpackThunk' :: MonadObelisk m => Bool -> FilePath -> m ()
567−unpackThunk' noTrail thunkDir = readThunk thunkDir >>= \case
575+unpackThunk' noTrail thunkDir = checkThunkDirectory thunkDir >> readThunk thunkDir >>= \case
568576 Left err -> failWith $ "thunk unpack: " <> T.pack (show err)
569577 --TODO: Overwrite option that rechecks out thunk; force option to do so even if working directory is dirty
570578 Right (ThunkData_Checkout _) -> failWith "thunk unpack: thunk is already unpacked"
@@ -601,7 +609,7 @@ packThunk :: MonadObelisk m => FilePath -> m ()
601609packThunk = packThunk' False
602610
603611packThunk' :: MonadObelisk m => Bool -> FilePath -> m ()
604−packThunk' noTrail thunkDir = readThunk thunkDir >>= \case
612+packThunk' noTrail thunkDir = checkThunkDirectory thunkDir >> readThunk thunkDir >>= \case
605613 Left err -> failWith $ T.pack $ "thunk pack: " <> show err
606614 Right (ThunkData_Packed _) -> failWith "pack: thunk is already packed"
607615 Right (ThunkData_Checkout _) -> do