Reject path components in internal command names

Library/Homebrew/brew.sh

@@ -478,6 +478,12 @@ case "${HOMEBREW_COMMAND}" in
   tc) HOMEBREW_COMMAND="typecheck" ;;
   x) HOMEBREW_COMMAND="exec" ;;
 esac
+
+# Keep in sync with `Commands.internal_cmd_name?` in `commands.rb`.
+if [[ "${HOMEBREW_COMMAND}" == */* || "${HOMEBREW_COMMAND}" == "." || "${HOMEBREW_COMMAND}" == ".." ]]
+then
+  odie "Unknown command: brew ${HOMEBREW_COMMAND}"
+fi
 # `update.sh` assumes normal repositories, so fail before it mutates a worktree.
 if [[ "${HOMEBREW_COMMAND}" == "update" && -z "${HOMEBREW_HELP}" && -f "${HOMEBREW_REPOSITORY}/.git" ]]
 then

Library/Homebrew/commands.rb

@@ -42,14 +42,20 @@ module Commands
   # middle due to dots in URLs or paths.
   DESCRIPTION_SPLITTING_PATTERN = /\.(?>\s|$)/
 
+  # Keep in sync with the command name check in `brew.sh`.
+  sig { params(cmd: String).returns(T::Boolean) }
+  def self.internal_cmd_name?(cmd)
+    cmd.exclude?("/") && %w[. ..].exclude?(cmd)
+  end
+
   sig { params(cmd: String).returns(T::Boolean) }
   def self.valid_internal_cmd?(cmd)
-    Utils::Ruby.require?(HOMEBREW_CMD_PATH/cmd)
+    internal_cmd_name?(cmd) && Utils::Ruby.require?(HOMEBREW_CMD_PATH/cmd)
   end
 
   sig { params(cmd: String).returns(T::Boolean) }
   def self.valid_internal_dev_cmd?(cmd)
-    Utils::Ruby.require?(HOMEBREW_DEV_CMD_PATH/cmd)
+    internal_cmd_name?(cmd) && Utils::Ruby.require?(HOMEBREW_DEV_CMD_PATH/cmd)
   end
 
   sig { params(cmd: String).returns(T::Boolean) }
@@ -75,6 +81,8 @@ def self.args_method_name(cmd_path)
 
   sig { params(cmd: String).returns(T.nilable(Pathname)) }
   def self.internal_cmd_path(cmd)
+    return unless internal_cmd_name?(cmd)
+
     [
       HOMEBREW_CMD_PATH/"#{cmd}.rb",
       HOMEBREW_CMD_PATH/"#{cmd}.sh",
@@ -83,6 +91,8 @@ def self.internal_cmd_path(cmd)
 
   sig { params(cmd: String).returns(T.nilable(Pathname)) }
   def self.internal_dev_cmd_path(cmd)
+    return unless internal_cmd_name?(cmd)
+
     [
       HOMEBREW_DEV_CMD_PATH/"#{cmd}.rb",
       HOMEBREW_DEV_CMD_PATH/"#{cmd}.sh",

Library/Homebrew/test/commands_spec.rb

@@ -41,6 +41,24 @@
 RSpec.describe Commands do
   include_context "custom internal commands"
 
+  test_each(["../other", ".", ".."]) do |cmd|
+    it "rejects #{cmd.inspect} before attempting to load an internal command" do
+      allow(Utils::Ruby).to receive(:require?).and_raise("Loading is not permitted")
+
+      expect(described_class.valid_internal_cmd?(cmd)).to be(false)
+    end
+
+    it "rejects #{cmd.inspect} before attempting to load an internal developer command" do
+      allow(Utils::Ruby).to receive(:require?).and_raise("Loading is not permitted")
+
+      expect(described_class.valid_internal_dev_cmd?(cmd)).to be(false)
+    end
+  end
+
+  it "does not resolve a path component as an internal command path" do
+    expect(described_class.path("../brew")).to be_nil
+  end
+
   specify "::internal_commands" do
     cmds = described_class.internal_commands
     expect(cmds).to include("rbcmd"), "Ruby commands files should be recognized"