Reject unsafe Windows update cache segments

install.ps1

@@ -276,10 +276,19 @@ function Normalize-PathForCompare($Path) {
     )
 }
 
+function Assert-NoRelativePathSegments($Path) {
+    foreach ($segment in ($Path -split '[\\/]')) {
+        if ($segment -eq "." -or $segment -eq "..") {
+            throw "refusing unsafe update cache path: $Path"
+        }
+    }
+}
+
 function Assert-SafeUpdateCache($Path) {
     if (-not $Path) {
         throw "refusing unsafe update cache path: $Path"
     }
+    Assert-NoRelativePathSegments $Path
     $full = Normalize-PathForCompare $Path
     $root = Normalize-PathForCompare ([System.IO.Path]::GetPathRoot($full))
     $homePath = Normalize-PathForCompare $HOME

tests/release_scripts.rs

@@ -99,6 +99,9 @@ fn installers_refuse_prebuilts_without_checksums() {
 fn windows_installer_reuses_persistent_source_update_cache() {
     let ps1 = include_str!("../install.ps1");
     assert!(ps1.contains("DOSH_UPDATE_CACHE"));
+    assert!(ps1.contains("Assert-NoRelativePathSegments($Path)"));
+    assert!(ps1.contains("Assert-NoRelativePathSegments $Path"));
+    assert!(ps1.contains("$segment -eq \".\" -or $segment -eq \"..\""));
     assert!(ps1.contains("$sourceCache = Assert-SafeUpdateCache $UpdateCache"));
     assert!(ps1.contains("git -C $sourceCache fetch --depth 1 origin main"));
     assert!(ps1.contains("git -C $sourceCache checkout -q -B main FETCH_HEAD"));